-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| tcg/voyager | composer | <= 1.8.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the interaction between two key behaviors in the upload method: 1) MIME type validation based on content-sniffing (bypassable via polyglot files), and 2) retention of the original file extension during storage. The $request->file->storeAs() call (line 238) writes the file using the user-controlled $name and $extension parameters. Since the code does not validate() the file extension against a whitelist, an attacker can upload a file with a .php extension disguised as an allowed MIME type (e.g., image/jpeg), resulting in arbitrary code execution when the file is accessed. The SonarSource blog explicitly identifies this flow as the root cause.
A Semantic Attack on Google Gemini - Read the Latest Research