-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.gaul:s3proxy | maven | < 2.6.0 | 2.6.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from insufficient validation of user-controlled input (container names and blob keys) in both the filesystem and filesystem-nio2 backends. The jclouds commit added validation checks in FilesystemBlobKeyValidatorImpl and FilesystemContainerNameValidatorImpl, indicating these were previously missing in functions like getBlob, removeBlob, and getContainerAccess. The s3proxy commit introduced path normalization and a checkValidPath guard in AbstractNio2BlobStore, showing that methods like list and getBlob previously resolved paths without ensuring they stayed within the container. The combination of missing validation and unconstrained path resolution allowed attackers to traverse directories via crafted inputs.