-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| wwbn/avideo | composer | >= 12.4, <= 14.2 | 14.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from unvalidated use of $_POST['systemRootPath'] in file inclusion operations. Both files used this parameter directly to construct paths for include/require operations. The GitHub patch replaces these with fixed paths using DIR, confirming these were the injection points. The PHP filter chain PoC demonstrates how controlling this parameter enables code execution via special wrappers. CWE-94 classification matches the pattern of code injection through user-controlled input in code inclusion functions.