-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/alist-org/alist/v3 | go | <= 3.16.3 |
Miggo AIRoot Cause AnalysisThe vulnerability description indicates improper access control in file upload functionality. While no specific code is shown, Go web applications typically handle uploads via controller functions. The combination of CWE-434 (unrestricted file upload) and the access control failure strongly suggests the upload handler function lacks: 1) Proper authorization checks verifying user privileges before accepting uploads, and 2) File type validation logic. The 'api' package and 'controllers' directory are common patterns for request handlers in Go web applications, making this the most likely location for the vulnerable upload processing logic.
Ongoing coverage of React2Shell