-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/donknap/dpanel | go | >= 1.2.0, <= 1.7.2 |
GoGoMiggo AIRoot Cause AnalysisThe analysis is based on the detailed vulnerability description provided in the GHSA advisory GHSA-gcqf-pxgg-gw8q. The advisory clearly identifies the GetFromUri function located in the app/application/http/controller/compose.go file as the source of the arbitrary file read vulnerability. The description specifies that the 'uri' parameter from the user's request is passed directly to os.ReadFile, which is a classic path traversal vulnerability pattern.
The provided Proof of Concept (PoC) confirms this, showing a POST request to the /api/app/compose/get-from-uri endpoint with a payload of {"uri":"/etc/passwd"} to read a sensitive system file.
While the exact patch commit was not available, the file content retrieved for compose.go shows the GetFromUri function now uses http.Get() instead of os.ReadFile(). This change strongly indicates that the developers attempted to patch the local file read vulnerability by changing the functionality to fetch a remote URL. This modification, while potentially introducing a different vulnerability (SSRF), serves as strong evidence for the location and nature of the original arbitrary file read vulnerability. Therefore, the controller.Compose.GetFromUri function is identified as the vulnerable function that would appear in a runtime profile during exploitation.
Ongoing coverage of React2Shell