-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| bagisto/bagisto | composer | <= 2.3.7 | 2.3.8 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in the file upload functionality of the TinyMCE editor in Bagisto. The root cause is insufficient validation on the backend when a file is uploaded. The analysis of the patch commit 7b6b1dd639a14e7053bb82ef2f971c1f533fdfab reveals that the storeMedia function in TinyMCEController.php was responsible for saving the uploaded file without proper checks.
The vulnerable version of storeMedia would accept a file, such as one named malicious.png, even if its content was actually HTML/JavaScript. The system would later process this file, and as described in the vulnerability report, rename it to .html, allowing the embedded script to be executed in the context of the user's browser when accessed.
The patch introduces two key validation steps:
image/png, image/jpeg).The upload function is the controller action that receives the HTTP request and calls storeMedia. Therefore, both functions would be present in the execution stack during a successful exploitation attempt. The primary flaw is within storeMedia, but upload is the entry point for the vulnerable operation.
Webkul\Admin\Http\Controllers\TinyMCEController::uploadpackages/Webkul/Admin/src/Http/Controllers/TinyMCEController.php
Webkul\Admin\Http\Controllers\TinyMCEController::storeMediapackages/Webkul/Admin/src/Http/Controllers/TinyMCEController.php
Ongoing coverage of React2Shell