Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ipl/web | composer | >= 0.11.0, <= 0.13.0 | 0.13.1 |
| ipl/web | composer | <= 0.10.2 | 0.10.3 |
Miggo AIRoot Cause AnalysisThe vulnerability is a reflected XSS in ipl/web due to malformed search requests. The analysis of the patch commit f387e92504d7a03bb857d1aee9b7410e06dd065d reveals that the vulnerability is fixed by adding a Content-Type header to the HTTP response in the postDispatch method of the CompatController class. The absence of this header in the vulnerable versions allowed browsers to incorrectly render the response as HTML, executing any injected scripts. The postDispatch function is responsible for finalizing the response, and the patch ensures that multipart responses are served with a content type that prevents them from being interpreted as HTML, thus mitigating the XSS risk. Therefore, Icinga\Module\Ipl\Compat\CompatController::postDispatch is the identified vulnerable function.
