-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| sulu/sulu | composer | >= 2.5.21, < 2.5.25 | 2.5.25 |
| sulu/sulu | composer | >= 2.6.5, < 2.6.9 | 2.6.9 |
| sulu/sulu | composer | >= 3.0.0-alpha1, < 3.0.0-alpha3 | 3.0.0-alpha3 |
Miggo AIRoot Cause AnalysisThe vulnerability description and the provided patch clearly indicate that the containsUnsafeContent function in SvgFileInspector.php was responsible for parsing SVG files in a way that was vulnerable to XXE. The patch directly modifies this function to disable external entity loading and substitution, which are the root cause of the XXE vulnerability. The commit message also confirms that the change is to fix an XXE issue.
KEV Misses 88% of Exploited CVEs- Get the report