-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe key vulnerability stems from the validate_path_is_safe function not decoding URL-encoded characters before validating path safety. The GitHub patch shows the addition of 'urllib.parse.unquote(path)' to decode the path first, and test cases were added to check encoded traversal patterns. The CWE-29 classification and commit message ('Prevent path traversal with encoded URL') directly implicate this function as the vulnerable component that allowed bypassing of path validation through encoding.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mlflow | pip | < 2.9.2 | 2.9.2 |
PythonPythonOngoing coverage of React2Shell