-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the getOnlineMediaId method in AbstractOnlineMediaHelper.php, which originally loaded full file contents without size checks. The security patches (9b2ecd2/aa2dcb3) explicitly added a 2048-byte size limit check in this function, confirming this was the vulnerable code path. The function's purpose of extracting media IDs from small metadata files made it susceptible to DoS when handling large files, as it would attempt to load multi-gigabyte files into memory.
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| typo3/cms-core | composer | >= 8.0.0, < 8.7.21 | 8.7.21 |
| typo3/cms-core | composer | >= 9.0.0, < 9.5.2 | 9.5.2 |
| typo3/cms-core |
| composer |
| >= 7.0.0, < 7.6.32 |
| 7.6.32 |
Ongoing coverage of React2Shell