-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe commit diff shows the vulnerability was in the restore() method's handling of ZIP file entries. Before the patch, it constructed targetpath by concatenating user-controlled 'name' values from the ZIP with project.full_path, without validating path normalization. The patch added a check using os.path.normpath() to prevent directory traversal. This matches CWE-73 (path injection) and the advisory's description of improper filename validation during backup restoration.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Weblate | pip | >= 4.14, < 5.6.2 | 5.6.2 |
Ongoing coverage of React2Shell