-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from Burn's use of C:\Windows\Temp without proper access controls when running elevated. CalculateWorkingFolder is directly responsible for selecting the working directory using GetTempPathW in SYSTEM context, while ExtractToTempDirectory handles file extraction to temporary locations. Both functions in their pre-patch form failed to implement necessary security measures (ACLs for SYSTEM-created directories and secure path generation), enabling the hijack chain. The commit diff shows these were the primary targets of the security fixes.
C#C#| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| PanelSW.Custom.WiX | nuget | <= 3.15.0-a45 | 3.15.0-a46 |
Ongoing coverage of React2Shell