-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper shell argument escaping in multiple methods interacting with ImageMagick's CLI. The commit diff shows critical changes from double-quote wrapping (") to single-quote escaping (') around variables like $image_fullpath and $filename in exec() calls. These variables often contain user-supplied filenames. Without proper escaping, special characters in filenames could break out of command arguments and execute arbitrary commands. The patch specifically addresses this by implementing consistent single-quote escaping, confirming these functions were vulnerable to OS command injection via crafted filenames.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| fuel/core | composer | < 1.8.0.4 | 1.8.0.4 |
PHPPHPKEV Misses 88% of Exploited CVEs- Get the report