-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stems from two primary issues: improper input validation in the form editor and insecure file handling via FAL. The form editor's save/preview actions did not filter user-submitted form definitions against allowed properties (CWE-89), enabling SQL injection through malicious YAML configurations. Additionally, functions like moveFile and func_edit in FAL-related classes allowed direct manipulation of form definition files (.form.yaml) without proper authorization checks, leading to privilege escalation. The patches introduced validation() checks in the form editor and restricted FAL operations, confirming these functions were vulnerable.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| typo3/cms-core | composer | >= 8.5.0, < 8.7.17 | 8.7.17 |
| typo3/cms-core | composer | >= 9.0.0, < 9.3.2 | 9.3.2 |
Ongoing coverage of React2Shell