-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| craftcms/cms | composer | >= 5.0.0-RC1, < 5.5.5 | 5.5.8 |
| craftcms/cms | composer | >= 4.0.0-RC1, < 4.13.8 | 4.13.8 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from insufficient validation in the database restoration process. The commit diff shows added path validation using FileHelper::isWithin, indicating the original code accepted user-controlled 'dbBackupPath' without checks. With a compromised security key, attackers could forge signed requests to execute arbitrary code through malicious database restore operations. The CWE-94 classification and patch context confirm this is a code injection vector via uncontrolled path input.
PHPPHPOngoing coverage of React2Shell