-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:electricflow | maven | < 1.1.33 | 1.1.33 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper symlink handling during file collection for publishing. The removed getFilesFromDirectory() lacked symlink checks, while the original getFilesFromDirectoryWildcardDirScanner() lacked the toRealPath() containment check added in the patch. Both allowed resolving symlinks outside the temp directory. The ElectricFlowClient.uploadArtifact()'s file processing was modified to use the safer endpoint-specific logic, but the root vulnerability resided in FileHelper's file collection methods.