-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/stashapp/stash | go | < 0.26.0 | 0.26.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper validation of the 'sort' parameter across multiple query builder functions. Analysis of the fix commit 8955386 shows these functions previously lacked whitelist validation for sort values. Each function directly incorporated user-controlled input into SQL ORDER BY clauses without proper sanitization, matching the CWE-89 pattern. The patch adds sortOptions validation to all these handlers, confirming they were vulnerable entry points. The consistent pattern across multiple entity handlers and explicit CVE description of sort parameter injection support high confidence.