-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Django | pip | >= 5.0, < 5.0.7 | 5.0.7 |
| Django | pip | >= 4.2, < 4.2.14 | 4.2.14 |
Miggo AIRoot Cause AnalysisThe vulnerability arises because the original save() method in Storage did not validate the filename before and after calling get_available_name(). Subclasses overriding generate_filename() (used by get_available_name()) without replicating the parent's validation could bypass checks. The patch added explicit validate_file_name() calls in save() to enforce validation regardless of subclass implementations. Thus, the unpatched save() method is the vulnerable function when used with such subclasses.
PythonPythonOngoing coverage of React2Shell