-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is a classic path traversal issue located in the dosagelib/comic.py file. The analysis of the commit 336a9684191604bc49eed7296b74bd582151181e clearly shows the vulnerable code and the corresponding fix. The ComicPage.connect function was identified as the vulnerable function because it is responsible for handling the HTTP response and constructing the filename for the downloaded image. Specifically, the code that processes the Content-Type header was flawed. It would take the subtype from the header and directly use it as part of the file extension. This allowed an attacker to inject path traversal sequences (../) into the filename via a malicious Content-Type header. The patch mitigates this by replacing the unsafe string manipulation with a call to mimetypes.guess_extension, which provides a safe way to map a MIME type to a file extension. Therefore, any runtime profile of an exploitation attempt would show the ComicPage.connect function in the stack trace.
ComicPage.connectdosagelib/comic.py
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| dosage | pip | < 3.2 | 3.2 |