-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from improper HTML escaping when rendering indexed volume names in the asset index utility. The commit 8c2ad0b shows the fix involved replacing dangerous string concatenation with safe DOM manipulation using jQuery.text() method. The original vulnerable code in getIndexingSessionRowHtml() constructed HTML list items directly from user-controlled indexedVolumes data, which contained unsanitized script tags from malicious asset names. The XSS triggers when this HTML is rendered in the admin interface during asset index updates.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| craftcms/cms | composer | >= 4.0.0-RC1, <= 4.4.5 | 4.4.6 |