-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| concrete5/concrete5 | composer | < 8.5.14 | 8.5.14 |
| concrete5/concrete5 | composer | >= 9.0.0, < 9.2.3 | 9.2.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from unescaped output of user-controlled layout preset names. The commit 077755e adds h() HTML escaping to these specific instances of getAreaLayoutPresetName() calls. The affected files show direct output of the preset name parameter without contextual encoding in admin UI components, making them injection points. The pattern matches classic stored XSS where admin-controlled input isn't sanitized before rendering.