-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| typo3/flow | composer | >= 2.3.0, < 2.3.7 | 2.3.7 |
| typo3/flow | composer | >= 3.0.0, < 3.0.1 | 3.0.1 |
PHPPHPMiggo AIRoot Cause AnalysisMediaTypeConverter::convert is explicitly named in the advisory as the XXE vector. The patch would have modified XML parsing here to disable external entities.ResourceManager::validateFileUpload (or similar validation method) would be responsible for enforcing extension restrictions. The 3.0.0 vulnerability stemmed from removed PHP blocking, indicating missing validation logic in this function prior to 3.0.1 patch. Both functions directly handle untrusted input (XML data and file uploads) and were modified in patched versions per advisory descriptions.Ongoing coverage of React2Shell