7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2023-4914

CVE-2023-4914: Cecil Path Traversal vulnerability

Relative Path Traversal in GitHub repository cecilapp/cecil prior to 7.47.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2023-4914

CVE-2023-4914:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
cecil/cecil	composer	< 7.47.1	7.47.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stems from procedural code in 'resources/server/router.php' that processes user-controlled input (REQUEST_URI) to construct file paths. The code used urldecode(parse_url($_SERVER['REQUEST_URI'])) to derive $path and concatenated it with DOCUMENT_ROOT to form $filename. This allowed path traversal via '../' sequences. The check 'if (!file_exists($filename) || is_dir($filename))' was insufficient because it didn't validate whether the resolved path was within DOCUMENT_ROOT. While built-in functions like urldecode, parse_url, file_exists, and is_dir are involved, the vulnerability arises from their insecure usage in the code flow rather than specific user-defined functions. The patch introduced realpath validation to address this, confirming the path stays within the intended directory.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.