CVE-2024-25154

CVE-2024-25154 affects FileCatalyst Direct 3.8.8 and earlier, due to improper URL validation that allows path traversal. An encoded payload can cause the web server to return files outside the web root, potentially leaking data. Public references in connected documents indicate remediation via up...

CVE-2024-25155

CVE-2024-25155 affects FileCatalyst Direct web server in versions 3.8.6–3.8.8. The issue arises from improper sanitization of illegal characters in URLs, which are then displayed on a subsequent error page. This can enable an attacker to craft a URL that executes arbitrary code within an HTML scr...