-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| InvokeAI | pip |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the get_path function's lack of input sanitization. The original implementation concatenated user-controlled 'image_name' with base directories without checking for path traversal characters. The patch adds basename extraction and path resolution checks, confirming the vulnerability existed in this function. The CWE-22 (Path Traversal) mapping and added test cases specifically targeting this function further validate this assessment.