-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from insufficient file type validation in the image upload process. The patch added a new isValidMimeType() check and modified the upload() method, indicating the original implementation in upload() only performed basic image validation via getimagesize(). This function can be tricked by files with valid image headers but malicious content, making MIME type validation essential. The pre-patch upload() function's lack of proper content-type validation directly enabled the unrestricted file upload vulnerability.
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| thorsten/phpmyfaq | composer | < 3.1.18 | 3.1.18 |
Ongoing coverage of React2Shell