CVE-2024-31450

🗓️ 19 Apr 2024 18:59:19Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 76 Views🌐 WEB

Owncast API allows path traversal attack via emoji/delete endpoint

Reporter	Title	Published	Views	Family All 12
CNNVD	Owncast 安全漏洞	19 Apr 202400:00	–	cnnvd
Cvelist	CVE-2024-31450 Owncast vulnerable to arbitrary file deletion in emoji.go (GHSL-2023-277)	19 Apr 202418:59	–	cvelist
EUVD	EUVD-2024-2541	3 Oct 202520:07	–	euvd
Github Security Blog	Owncast Path Traversal vulnerability	5 Aug 202421:29	–	github
NVD	CVE-2024-31450	19 Apr 202419:15	–	nvd
OSV	CVE-2024-31450 Owncast vulnerable to arbitrary file deletion in emoji.go (GHSL-2023-277)	19 Apr 202418:59	–	osv
OSV	GHSA-9355-27M8-H74V Owncast Path Traversal vulnerability	5 Aug 202421:29	–	osv
OSV	GO-2024-2741 Owncast Path Traversal vulnerability in github.com/owncast/owncast	4 Jun 202415:19	–	osv
Positive Technologies	PT-2024-24084 · Owncast · Owncast	19 Apr 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-31450	23 May 202510:18	–	redhatcve

NVD

Vulners

Vulnrichment

Node

owncast_project owncastRange<0.1.3

[
  {
    "vendor": "owncast",
    "product": "owncast",
    "versions": [
      {
        "version": "< 0.1.3",
        "status": "affected"
      }
    ]
  }
]

Source	Link
securitylab	www.securitylab.github.com/advisories/GHSL-2023-277_Owncast/
github	www.github.com/owncast/owncast/blob/v0.1.2/controllers/admin/emoji.go
github	www.github.com/owncast/owncast/commit/1b14800c7d7f54be14ed4d130bfe7f480645076e
github	www.github.com/owncast/owncast/releases/tag/v0.1.3

Parameter	Position	Path	Description	CWE
<unspecified parameter name>	request body	/api/admin/emoji/delete	Path traversal vulnerability in emoji delete endpoint allows deletion of arbitrary files by constructing a path from a JSON parameter that is appended to the emoji filepath.	CWE-22

15 Oct 2025 14:59Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.12.7 - 6.5

EPSS0.00126

SSVC

CWE-22