-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| cockpit-hq/cockpit | composer | < 2.6.3 | 2.6.3 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability arises from insufficient validation of file extensions during upload. The patch explicitly adds '.phps' to the list of blocked extensions in the file modules/Assets/bootstrap.php, confirming that the original code allowed such files. This oversight enabled attackers to upload malicious PHP files (e.g., .phps) via the system's file upload utility. The improper validation in this file directly maps to CWE-98 (PHP RFI), as the application did not properly restrict filenames for inclusion/execution. The code change in the commit and the CWE classification strongly indicate that the file upload handler in this file was the vulnerable component.