-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability lies in the handling of uploaded files within the Myfiles controller. The provided patch e908ade21c84bdc9d51190057482316730c66146 clearly shows modifications to Core/Controller/Myfiles.php. The key change is in the run() method, which is responsible for serving the files. Previously, the code only forced a download for SVG files. The patch expands this protection to include XML, HTML, and other potentially dangerous file types by replacing isSvg() with a more comprehensive shouldForceDownload() check. This indicates that the run() method was the point of vulnerability, as it would serve user-uploaded XML files with a content type that allowed browsers to execute embedded scripts, leading to the stored XSS. The run() function is therefore the primary vulnerable function that would appear in a runtime profile during the exploitation of this vulnerability.
Myfiles::runCore/Controller/Myfiles.php
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| facturascripts/facturascripts | composer | <= 2025.4 | |
| facturascripts/facturascripts | composer | = 2025.11 | |
| facturascripts/facturascripts | composer | = 2025.41 | |
| facturascripts/facturascripts | composer | = 2025.43 |
A Semantic Attack on Google Gemini - Read the Latest Research