CVE-2024-36858

Summary: CVE-2024-36858 affects Jan v0.4.12 via the /v1/app/writeFileSync endpoint, where an arbitrary file upload vulnerability allows an attacker to execute arbitrary code. The root cause is an insecure file upload interface that does not sufficiently validate uploaded content. The impact is de...

CVE-2024-36857

CVE-2024-36857 affects Jan v0.4.12, which contains an arbitrary file read vulnerability exposed through the /v1/app/readFileSync interface. The connected template details a path traversal flaw that allows unauthenticated attackers to read arbitrary files on the system, via a vulnerable readFileSy...

CVE-2024-37273

CVE-2024-37273 affects the Jan project, specifically version 0.4.12 . The vulnerability lies in the /v1/app/appendFileSync interface, where uploading a crafted file can lead to arbitrary code execution on the server. The available connected document details confirm this arbitrary-file-upload flaw...