-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability exists in the storage API endpoint (/api/storage/buckets/*/objects) where user input directly influences filesystem paths. The LinkedIn PoC demonstrates path traversal via GET requests, and the advisory mentions the fix involved implementing getCanonicalPath() to resolve paths properly. This indicates the original implementation lacked proper path normalization/sanitization in the GET request handler for storage objects. While exact code isn't available, the pattern matches CWE-22 vulnerabilities where user input is concatenated to base paths without validation.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.yamcs:yamcs | maven | < 5.8.7 | 5.8.7 |
JavaJavaOngoing coverage of React2Shell