-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| typo3/cms | composer | >= 6.2.0, < 6.2.29 | 6.2.29 |
| typo3/cms | composer | >= 7.6.0, < 7.6.13 | 7.6.13 |
| typo3/cms | composer | >= 8.0.0, < 8.4.1 | 8.4.1 |
Miggo AIRoot Cause AnalysisThe vulnerability centers on improper path validation when handling invalid UTF-8. TYPO3's GeneralUtility::validPathStr is the canonical method for sanitizing file paths against directory traversal. The security bulletin's description of a 'too loose type check' aligns with this function's responsibility to validate path strings. While no direct patch code is provided, the function's role in path validation and the nature of the vulnerability (UTF-8 bypass) make it the clear candidate. Runtime exploitation would involve this function processing malicious input with invalid encoding.
Ongoing coverage of React2Shell