CVE-2024-49760 OpenRefine has a path traversal in LoadLanguageCommand

OpenRefine is a free, open source tool for working with messy data. The load-language command expects a lang parameter from which it constructs the path of the localization file to load, of the form translations-$LANG.json. But when doing so in versions prior to 3.8.3, it does not check that the...

CVE-2024-49760 OpenRefine has a path traversal in LoadLanguageCommand

OpenRefine is a free, open source tool for working with messy data. The load-language command expects a lang parameter from which it constructs the path of the localization file to load, of the form translations-$LANG.json. But when doing so in versions prior to 3.8.3, it does not check that the...

CVE-2024-49760

CVE-2024-49760 affects OpenRefine: in versions prior to 3.8.3 the load-language command does not verify the target directory, enabling a path traversal to read other JSON files on the file system. The issue is resolved in 3.8.3. Impact details and exploit information are stated in provided docume...

GHSA-QFWQ-6JH6-8XX4 OpenRefine has a path traversal in LoadLanguageCommand

The load-language command expects a lang parameter from which it constructs the path of the localization file to load, of the form translations-$LANG.json. When doing so, it does not check that the resulting path is in the expected directory, which means that this command could be exploited to re...

OpenRefine has a path traversal in LoadLanguageCommand

The load-language command expects a lang parameter from which it constructs the path of the localization file to load, of the form translations-$LANG.json. When doing so, it does not check that the resulting path is in the expected directory, which means that this command could be exploited to re...