-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| agentscope | pip |
Miggo AIRoot Cause AnalysisThe vulnerability exists in the /api/file endpoint handled by the _get_file function. The function retrieves the 'path' parameter from request arguments and passes it directly to send_file() without any validation. There is no: 1) Path normalization, 2) Restriction to a safe base directory, or 3) Check for directory traversal sequences. This matches the CWE-22 description and the advisory's technical details about unsanitized path parameters enabling arbitrary file read.