-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| librenms/librenms | composer | < 25.7.0 | 25.7.0 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in the html/ajax_form.php script. The analysis of the provided patch ec89714d929ef0cf2321957ed9198b0f18396c81 clearly shows the remediation of a Local File Inclusion (LFI) vulnerability. The original code dynamically included a file based on the $_POST['type'] parameter without proper validation, using include_once 'includes/html/forms/' . $_POST['type'] . '.inc.php';. This is a classic LFI pattern. The fix replaces this dynamic inclusion with a match statement that acts as a strict allow-list, ensuring only expected files can be included. Since the vulnerable code is in the main execution body of ajax_form.php and not within a defined function, the script itself is the vulnerable component. A runtime profiler would show execution within ajax_form.php when the vulnerability is triggered.
Ongoing coverage of React2Shell