-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| studio-42/elfinder | composer | < 2.1.62 | 2.1.62 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the _joinPath function's insufficient validation of directory paths. The commit bb9aaa7 explicitly adds checks for '..' in the $dir parameter and resets it to root if detected, proving this was the attack vector. The CVE description and NVD references directly attribute the vulnerability to this function's handling of path concatenation. The function's role in constructing filesystem paths makes it the logical point of failure for path traversal attacks.