GHSA-JRH5-VHR9-QH7Q Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution

🗓️ 13 Nov 2024 14:12:36Reported by GoogleType

osv🔗 osv.dev👁 19 Views

CraftCMS vulnerability allows bypassing local file system validation, leading to file overwrite, sensitive file access, and potential code executio

Reporter	Title	Published	Views	Family All 14
BDU FSTEC	The vulnerability of the Craft CMS content management system lies in the improper restriction on the path to the restricted catalog. This allows a hacker to execute arbitrary code or perform Server Side Template Injection (SSTI) attacks.	4 Feb 202500:00	–	bdu_fstec
Circl	CVE-2024-52291	13 Nov 202400:30	–	circl
CNNVD	CraftCMS 路径遍历漏洞	13 Nov 202400:00	–	cnnvd
CVE	CVE-2024-52291	13 Nov 202416:12	–	cve
Cvelist	CVE-2024-52291 Craft has a Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution	13 Nov 202416:12	–	cvelist
EUVD	EUVD-2024-3276	3 Oct 202520:07	–	euvd
Github Security Blog	Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution	13 Nov 202414:12	–	github
NVD	CVE-2024-52291	13 Nov 202417:15	–	nvd
OSV	CLSA-2026-1774313530 TuxCare security update for craftcms/cms (10 CVEs)	4 Aug 202614:52	–	osv
Positive Technologies	PT-2024-35157 · Craft Cms · Craft Cms	13 Nov 202400:00	–	ptsecurity

Source	Link
github	www.github.com/craftcms/cms/security/advisories/GHSA-jrh5-vhr9-qh7q
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-52291
github	www.github.com/craftcms/cms

13 Nov 2024 19:08Current

8.3High risk

Vulners AI Score8.3

CVSS 3.18.4

CVSS 48.7

EPSS0.01172