-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the downloadBinaryFileAction method accepting a user-provided 'filename' parameter. The commit diff shows this parameter was removed from the Content-Disposition header generation and replaced with $field->value->fileName. This indicates the original implementation's direct use of user input for filenames was the root cause. The routing change from redirectToContentDownloadAction to downloadBinaryFileByIdAction further confirms the attack surface was in the original filename handling logic.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ezsystems/ezplatform-kernel | composer | >= 1.3.0, < 1.3.34 | 1.3.34 |
PHPPHPOngoing coverage of React2Shell