-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| webui-aria2 | npm | <= 1.0.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from line 10 in node-server.js where user-controlled URI input is directly used to construct file paths without proper sanitization. The path.join() operation combined with unsanitized URI parameters allows directory traversal attacks. The code subsequently serves files from the constructed path without verifying if it remains within the intended 'docs' directory. This matches the CWE-22 description and the PoC demonstrating access to /etc/passwd confirms the exploitability.
JavaScriptJavaScriptOngoing coverage of React2Shell