-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stemmed from improper HTML escaping in email content. The commit shows:
These changes indicate the original Purifier::clean() function failed to properly neutralize HTML in user-controlled fields like password descriptions when generating emails, allowing img tag injection. The high confidence comes from the direct correlation between the patch (switching to htmlspecialchars) and the vulnerability type (HTML injection).
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| passbolt/passbolt_api | composer | < 2.7.0 | 2.7.0 |
Ongoing coverage of React2Shell