-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| backpack/filemanager | composer | >= 3.0.0, < 3.0.9 | 3.0.9 |
| backpack/filemanager | composer | < 2.0.2 | 2.0.2 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stems from the insecure deserialization of the 'mimes' parameter. The commit introduces a new BackpackElfinderController that adds decryption and validation(). Prior to the patch, the code likely used the original ElfinderController's showPopup method (or similar) which directly deserialized user-controlled 'mimes' data without proper checks. The fix involves decrypting the parameter first, indicating that the previous implementation lacked this security step, making deserialization of untrusted data possible.
Ongoing coverage of React2Shell