-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| lollms | pip | < 9.5.0 | 9.5.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from insufficient validation of absolute paths starting with '/' in Windows environments. Both functions lacked checks for leading forward slashes (added in the patch), which Windows interprets as valid path separators. This allowed attackers to bypass traversal protections by crafting paths like '/../sensitive_file'. The commit diff explicitly shows these checks were added to both functions to mitigate the vulnerability, confirming their role in the insecure implementation.