-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from unsafe unserialize() usage in the downloadCustomOptionAction controller flow. The controller receives user input via GET parameters which is passed to getCustomOptionFile helper where unserialize() is executed. Both functions would appear in stack traces when processing malicious requests. The patch evidence from vendor advisories explicitly mentions replacing unserialize with json_decode in these files, confirming their role in the exploit chain.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| cart2quote/module-quotation-encoded | composer | >= 4.1.6, <= 4.4.5 | |
| cart2quote/module-quotation-encoded | composer | >= 5.0.0, < 5.4.4 | 5.4.4 |
Ongoing coverage of React2Shell