-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from two key functions: 1) FileCollectionController::upload acts as the entry point, handling HTTP upload requests. 2) FileCollectionModel::upload performs the critical security check using an allow-list that includes dangerous file types (SVG/PDF) based solely on extensions. The code explicitly shows these types are allowed in config.php, and no content validation occurs after the extension check. This allows attackers to upload files with executable JavaScript, leading to stored XSS. Both functions are directly involved in the insecure workflow, with high confidence derived from the disclosed code snippets and the vendor's withdrawn admission that JS execution was intentional.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| automad/automad | composer | <= 1.10.9 |
A Semantic Attack on Google Gemini - Read the Latest Research