-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| baserproject/basercms | composer | < 4.7.5 | 4.7.5 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stems from improper validation handling in the file upload workflow. The commit diff shows critical changes to BcUploadBehavior.afterValidate method - adding validation error checks before processing upload data. Previously, even when validation errors occurred (e.g., invalid file types), the code would still process the upload via setupRequestData and setupTmpData. This bypass allowed dangerous file uploads. The CWE-434 mapping confirms this is an unrestricted file upload vulnerability directly tied to validation logic flaws in upload handling functions.
Ongoing coverage of React2Shell