-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/clidey/whodb/core | go | < 0.0.0-20250127172032-547336ac73c8 | 0.0.0-20250127172032-547336ac73c8 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the DB function in sqlite3/db.go where user-controlled 'database' parameter is directly joined with the default directory using filepath.Join(). Before the patch, there was no check to ensure the final path stays within the allowed directory. The critical line 'fileNameDatabase := filepath.Join(getDefaultDirectory(), database)' combines untrusted input with a base path, and the subsequent os.Stat() check only verifies file existence - not path containment. The patch added a 'strings.HasPrefix' check to enforce directory containment, confirming this was the missing validation.