-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| prestashop/blockreassurance | composer | <= 5.1.3 | 5.1.4 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper path validation when deleting files associated with blocks. The commit diff shows the fix added path constraints (using img_path_perso directory and basename()) in displayAjaxDeleteBlock, indicating this was the vulnerable function. The original implementation used user-supplied 'custom_icon' value directly in file path construction, enabling arbitrary file deletion when combined with unlink(). CWE-285 (Improper Authorization) matches this pattern of missing access controls on file operations.
Ongoing coverage of React2Shell