-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| gradio | pip | < 4.19.2 | 4.19.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper path validation in file handling functions. The patch added 'check_in_upload_folder' checks in move_files_to_cache and 'explicit_call' controls in preprocess_data to restrict file operations to the upload directory. The affected functions directly handled user-supplied file paths without these validations in vulnerable versions, enabling path traversal through the /queue/join endpoint. The commit diff shows these security checks were added precisely in these functions to address the LFI vulnerability.