CVE-2024-27292

The expert system Docassemble is vulnerable to unauthenticated path traversal and Local File Inclusion (LFI) in versions 1.4.53 to 1.4.96 . By performing URL manipulation on the interview endpoint, an attacker can gain unauthorized access to read arbitrary files on the server. The impact is class...

CVE-2024-27290

Docassemble is affected by an HTML/JavaScript injection vulnerability in which an attacker could input HTML in a field (notably the user’s name) and have it rendered as HTML. This stems from improper handling of user-supplied HTML prior to version 1.4.97. The issue has been fixed in the master br...

CVE-2024-27291

CVE-2024-27291 concerns Docassemble, an expert system for guided interviews and document assembly. The issue is an open redirect vulnerability: before version 1.4.97, a crafted URL can cause a user to be redirected to an arbitrary site due to improper URL handling. The open redirect is mitigated ...