-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.graylog2:graylog2-server | maven | >= 5.1.0, < 5.1.3 | 5.1.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from improper path validation in ensureFileWithinBundleDir. The pre-patch version: 1) Only checked canonical path startsWith() match 2) Used File.getCanonicalPath() which has platform-specific behavior 3) Did not properly normalize paths before comparison. The fix changed the validation to use absolutePath().normalize() and made the bundleDir parameter explicit, demonstrating the original function's validation was insufficient to prevent directory traversal in sibling directories sharing the support-bundle prefix.