-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the DeleteCustomEmoji function in controllers/admin/emoji.go. The function uses emoji.Name from the request payload to build a filesystem path via filepath.Join(config.CustomEmojiPath, emoji.Name). Prior to the patch, there was no validation to ensure the resulting path remained within the intended directory. The commit diff shows the addition of filepath.IsLocal(targetPath) to mitigate this, confirming the original code lacked sanitization. The combination of user-controlled input being appended to a filesystem path and the absence of traversal checks directly enables the exploit.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/owncast/owncast | go | < 0.1.3 | 0.1.3 |
A Semantic Attack on Google Gemini - Read the Latest Research