-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| froxlor/froxlor | composer | < 2.0.11 | 2.0.11 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stemmed from the settings import functionality. The pre-patch version in SImExporter.php lacked the Form::processForm() validation layer, which the patch added to ensure the same security checks as regular admin settings updates. The original code directly wrote base64-decoded image data to files without proper mime-type/extension validation, and applied settings without input filtering, creating an injection vector. The commit message explicitly states the fix was to 'apply the same validations' via Form::processForm(), confirming the vulnerability was in the import handling logic.