-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/zitadel/zitadel | go | < 2.42.17 | 2.42.17 |
| github.com/zitadel/zitadel | go | >= 2.43.0, < 2.43.11 | 2.43.11 |
| github.com/zitadel/zitadel | go | >= 2.44.0, < 2.44.7 | 2.44.7 |
| github.com/zitadel/zitadel | go | >= 2.45.0, < 2.45.5 | 2.45.5 |
| github.com/zitadel/zitadel | go | >= 2.46.0, < 2.46.5 | 2.46.5 |
| github.com/zitadel/zitadel | go | >= 2.47.0, < 2.47.8 | 2.47.8 |
| github.com/zitadel/zitadel | go | >= 2.48.0, < 2.48.3 | 2.48.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper MIME type validation during file uploads. The patch notes explicitly mention adding 'detect mime type of uploaded asset' as a fix, indicating the original implementation lacked proper content sniffing. The vulnerability pattern matches functions handling file uploads without server-side content-type verification, which would normally prevent HTML files from being stored as images. The cross-version consistency of the fix (same commit message across all patched versions) strongly suggests a centralized upload handling function was vulnerable.
Ongoing coverage of React2Shell