-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper symlink handling in archival requests. The patch introduced _is_valid_xlog_path() to check both file existence and symlink status, replacing the vulnerable os.path.exists() check in handle_archival_request. The commit message and test case additions confirm the issue was specifically about symlink traversal during archival operations.
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pghoard | pip | < 2.6.1-rc | 2.6.1-rc |
Ongoing coverage of React2Shell