-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| bagisto/bagisto | composer | < 2.3.10 | 2.3.10 |
Miggo AIRoot Cause AnalysisThe analysis is based on the commit f533b1cd9c80896792da60976179c95573d78b79, which was provided as a reference for the vulnerability. The vulnerability description highlights a stored XSS in the CMS page editor. However, the patch in the provided commit addresses a stored XSS vulnerability in the product review attachments feature, not the CMS editor. The commit modifies the upload function within the ProductReviewAttachmentRepository to add sanitization for SVG files. Before this change, the lack of sanitization made the upload function vulnerable. While the root cause is similar (insufficient server-side sanitization), the affected component in the patch is different from the one in the description. This analysis focuses on the concrete evidence from the provided patch.
Webkul\Product\Repositories\ProductReviewAttachmentRepository::uploadpackages/Webkul/Product/src/Repositories/ProductReviewAttachmentRepository.php