-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @adonisjs/bodyparser | npm | < 10.1.2 | 10.1.2 |
| @adonisjs/bodyparser | npm | >= 11.0.0-next.0, < 11.0.0-next.6 | 11.0.0-next.6 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in the @adonisjs/bodyparser package. The MultipartFile.move method is responsible for moving uploaded files to a destination directory. The patch commits 143a16f35602be8561215611582211dec280cae6 and 6795c0e3fa824ae275bbd992aae60609e96f0f03 clearly show that the default behavior of this method was to use the clientName from the multipart form data as the filename. This clientName is user-controllable and was not sanitized, leading to a path traversal vulnerability. The fix replaces the use of clientName with a randomly generated filename, thus mitigating the vulnerability. Therefore, any code path that calls MultipartFile.move without explicitly providing a safe filename in the options is vulnerable.
MultipartFile.movesrc/multipart/file.ts