-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| prestashop/prestashop | composer | <= 8.1.0 | 8.1.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper input validation in the CustomerMessage::delete() method. The commit diff shows the critical fix adds basename() to sanitize $this->file_name, confirming the original implementation lacked path traversal protection. Since this method handles file deletion and directly used untrusted input (file_name) in a filesystem operation without validation, it meets CWE-20 criteria. The high confidence comes from the direct correlation between the patch's modification and the vulnerability description.
Ongoing coverage of React2Shell