-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| showdoc/showdoc | composer | < 2.8.7 | 2.8.7 |
PHPPHPMiggo AIRoot Cause AnalysisThe analysis started by examining the provided pull request URL, which pointed to a specific commit. The commit information was then fetched. The commit diff clearly showed a change in the uploadImg function within the PageController.class.php file. The change from $upload->allowExts to $upload->exts directly addresses the improper validation of file extensions. The pull request description further confirmed that allowExts was the incorrect property and that the uploadImg method also lacked authentication checks. This combination of evidence points to ShowDoc\Home\Controller\PageController::uploadImg as the vulnerable function responsible for processing the file upload and failing to restrict file types properly.
Ongoing coverage of React2Shell