-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nilsteampassnet/teampass | composer | < 3.0.0.23 | 3.0.0.23 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from using a predictable/hardcoded filename (teampass-seckey.txt) for the encryption key storage. The patch introduced filename randomization through the SECUREFILE constant (generated via generateRandomKey()) and updated all references to use this dynamic name. The vulnerable functions were those that handled the key file path without randomization, which could be controlled by attackers to compromise encryption security. The high confidence comes from direct code changes in the commit diff showing the transition from static filenames to randomized ones in these functions.
PHPPHPOngoing coverage of React2Shell