-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability explicitly occurs in the file upload endpoint handler. The key failure is insufficient validation of user-controlled filename parameters when writing files. Though the exact code isn't shown, the advisory's description of crafted filenames leading to arbitrary writes matches classic path traversal vulnerabilities in file upload handlers. The Windows-specific context suggests improper handling of path separators. The first patched version removed LightningApp code (commit 330af38), implying the vulnerable logic resided in the app component's file upload handling.
PythonPythonOngoing coverage of React2Shell
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pytorch-lightning | pip |