-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| october/cms | composer | <= 3.4.16 |
Miggo AIRoot Cause AnalysisThe critical vulnerability was in the error handling flow where user-supplied dbhost input was reflected without proper escaping. The patch added $this->e() to sanitize output in die($ex->getMessage()), indicating the original unescaped die() call was the vulnerability source. The InstallerHandlers.php changes were spelling fixes unrelated to security. The XSS trigger requires: 1) User input in dbhost 2) Error condition during installation 3) Unescaped output in error display - all confirmed by the commit diff and vulnerability description.