-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| contao/contao | composer | >= 4.9.0, < 4.9.40 | 4.9.40 |
| contao/contao | composer | >= 4.13.0, < 4.13.21 | 4.13.21 |
| contao/contao | composer | >= 5.1.0, < 5.1.4 | 5.1.4 |
PHPPHPMiggo AIRoot Cause AnalysisThe patch adds critical validation in ajaxTreeView (isValid check + directory existence/mount verification) and fixes the isMounted logic. The vulnerability stemmed from 1) unvalidated user input in ajaxTreeView's folder parameter, and 2) over-permissive mount check in isMounted. These functions directly handle path resolution and access control for file manager operations.
Ongoing coverage of React2Shell