-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.jfinal:jfinal | maven | <= 5.0.0 |
Miggo AIRoot Cause AnalysisThe vulnerability manifests in two key layers: 1) The framework's request handling that allows parameter injection into file operations, and 2) The controller method specifically processing the file download request. The combination of these components enables unvalidated user input (fileKey) to be used in file path construction. While exact implementation details aren't available, JFinal's architecture patterns and the described vulnerability mechanism strongly indicate these entry points. The high confidence comes from the direct match between the described attack vector (../ in fileKey parameter) and typical JFinal controller parameter handling practices.
JavaJavaOngoing coverage of React2Shell