-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| open-webui | pip | <= 0.3.8 |
PythonPythonMiggo AIRoot Cause AnalysisThe vulnerability stems from the file upload handler referenced in GitHub's main.py line 1513. The advisory explicitly states unsanitized filename concatenation with CACHE_DIR as the root cause. The code likely uses user-supplied filename directly in os.path.join() or similar file operations without normalization/sanitization checks. This matches the CWE-22 pattern where user-controlled filenames can contain path traversal sequences (../../) to escape the restricted directory. The high confidence comes from multiple sources (GHSA, CVE, huntr) all pointing to this specific endpoint and code pattern.
Ongoing coverage of React2Shell