-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ibexa/core | composer | >= 4.5.0, < 4.5.6 | 4.5.6 |
| ibexa/core | composer | >= 4.6.0, < 4.6.2 | 4.6.2 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stemmed from missing file extension validation during draft persistence. The patch adds FileExtensionBlackListValidator checks directly in the storeFieldData methods of both storage handlers. These methods are responsible for writing field data to storage regardless of publication status. Before the fix, they executed storage operations without validating against the blacklist at the persistence layer, allowing restricted files to be stored in draft state. The YAML configuration changes and added validator dependencies confirm these were the entry points for unauthorized storage.
KEV Misses 88% of Exploited CVEs- Get the report