-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| october/october | composer | <= 3.6.4 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from two key factors: 1) Unrestricted PDF upload capability (CWE-434) in the Media Manager component, and 2) Lack of input sanitization for embedded JavaScript in PDF files (CWE-79). The Media controller's upload handler (onUpload) is the logical entry point for file processing. While it likely performs basic file type checks (allowing PDFs), it doesn't implement content analysis to detect malicious scripts. When combined with insecure rendering of user-uploaded PDFs in browser contexts that execute embedded JavaScript, this creates an XSS vector. The PoC explicitly references the /admin/media upload path and direct execution upon file access, confirming the Media controller's role.