CVE-2026-7059 Details

A path traversal vulnerability has been identified in 666ghj MiroFish versions through 0.1.2. The issue arises in the Query Parameter Handler component, specifically within the get_simulation_posts function of backend/app/api/simulation.py. The vulnerability allows for arbitrary SQLite database reads by manipulating the platform query parameter. The lack of validation on the platform argument enables attackers to inject ../ sequences, potentially accessing any SQLite database file that ends with _simulation.db from various directories on the server. This vulnerability can be exploited remotely without authentication.

Whitelist the platform parameter to allow only predefined values, such as 'twitter' or 'reddit'. This can be done by modifying the get_simulation_posts and get_simulation_comments functions to include a validation step that checks the platform value against an allowed list.