-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| october/system | composer | >= 3.0.0, < 3.4.15 | 3.4.15 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper enforcement of cms.safe_mode restrictions when processing CMS templates. Functions handling template rendering (e.g., renderPage) and backend save operations (e.g., onSave) are critical points where user input could bypass safe mode checks. These functions likely lacked proper validation to strip or block PHP code in templates when safe mode was enabled, allowing crafted payloads to execute. The high confidence stems from the CWE-94 context (code injection) and the workflow described in the advisory, where backend users with template editing permissions exploit these functions to inject PHP.
PHPPHPOngoing coverage of React2Shell