-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the getFile method's insecure path handling. The commit diff shows critical changes: 1) Added path normalization 2) Added 'startsWith' check to prevent directory escape. The original code lacked these protections, making it vulnerable to path traversal via malicious fileName parameters. Test cases added in LocalFileLogServerFactoryTest.java explicitly validate these fixes by testing '../' and absolute path cases, confirming this was the attack vector.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.digdag:digdag-server | maven | < 0.10.5.1 | 0.10.5.1 |