-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| appwrite/server-ce | composer | <= 1.2.1 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability manifests in the favicon endpoint handler which accepts a user-controlled 'url' parameter. The function likely passes this parameter directly to a HTTP client without proper SSRF protections (like validating allowed domains or blocking internal network targets). This matches the SSRF pattern where attacker-controlled URLs are fetched by the server. While exact code isn't available, the endpoint's functionality and vulnerability description strongly indicate the controller.method handling this route is the vulnerable component.
KEV Misses 88% of Exploited CVEs- Get the report