PHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|
| wallabag/wallabag | composer | >= 2.0.0-alpha.1, <= 2.6.2 | 2.6.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from two key issues in the resetAction function: 1) The @Route annotation originally allowed GET requests (default method) for destructive operations, making CSRF exploitation trivial via malicious links/embedded content. 2) There was no CSRF token validation in the original implementation. The patch added both POST method restriction and CSRF checks, confirming that these were the vulnerable aspects. The template changes from <a> links to <form> submissions with CSRF tokens further validate that the controller's GET handler was the vulnerable component.
KEV Misses 88% of Exploited CVEs- Get the report
