-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper neutralization of file/folder names during rendering. The advisory and release notes indicate that sanitization was added in the fix (e.g., commit eb803ab in 8.5.13). While exact code diffs are unavailable, the core issue lies in functions outputting raw file/folder names. The File entity's methods (e.g., getFileName()) or view templates rendering these names without escaping are likely culprits. The medium confidence reflects inferred logic from patch descriptions, though specific function names/paths aren't explicitly provided in the data.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| concrete5/concrete5 | composer | < 9.1.0 | 9.1.0 |
PHPPHPOngoing coverage of React2Shell