-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.noear:solon-web-staticfiles | maven | < 3.0.9 | 3.0.9 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the StaticMappings.find() method's lack of path traversal validation prior to the patch. The commit f46e47f explicitly adds a '/../' check at the start of the method, indicating this was the vulnerable code path. The CWE-23 classification and GitHub advisory both confirm this is a relative path traversal issue in static file handling. The function's role in resolving static resources makes it the logical entry point for this vulnerability.