-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from improper path validation in the storage API's DELETE handler. While explicit code diffs aren't available, the advisory and technical analysis confirm: 1) The attack vector is HTTP DELETE to /api/storage/buckets endpoints 2) The fix in 5.8.7 involved proper path canonicalization (mentioned in VisionSpace's recommendation) 3) CWE-22 pattern matches path traversal via unsanitized user input. The StorageController's delete handler is the logical component processing these requests, making it the vulnerable entry point.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.yamcs:yamcs | maven | < 5.8.7 | 5.8.7 |
Ongoing coverage of React2Shell