-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability description explicitly identifies the Typeahead API endpoint as the attack vector. While no specific code is shown, web API handlers typically follow a pattern where endpoint methods like handle_request process input parameters. The exposure of root directory listings when '/' is submitted strongly suggests this function: 1) Accepts raw user input as a filesystem path 2) Uses it in directory listing operations 3) Fails to validate() against path traversal or root access. The high confidence comes from the precise vulnerability pattern matching common directory traversal flaws in web handlers, combined with the explicit API endpoint attribution in multiple advisory sources.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| h2o | pip | <= 3.40.0.4 |
PythonPython