-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from two key functions: 1) RemoteFile::exists performed insecure HEAD requests without host allowlisting, enabling initial SSRF probes. 2) ProductsTable::changeImage's workflow first checked file existence via HEAD, then downloaded via GET without re-validating the target - a classic TOCTOU pattern. The patch added host verification in exists() and switched to mime type checking, confirming these were the vulnerable points. The test cases added for invalid domains and mime types in the commit further validate() these as the vulnerable components.
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| foodcoopshop/foodcoopshop | composer | >= 3.2.0, < 3.6.1 | 3.6.1 |
KEV Misses 88% of Exploited CVEs- Get the report