GitHub Advisoryadvisory · Packagist
GHSA-4p75-5p53-65m9 Contao affected by directory traversal in the file selector widget
MEDIUM
Official page ↗
- Aliases
- CVE-2024-45604
- Ecosystem
- Packagist
- Packages
- contao/core-bundle
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-22
- Reviewed
- 2024-09-17
Affected packages
• Packagist contao/core-bundle: < 4.13.49 → fixed in 4.13.49
Description
Impact
Back end users can list files outside their file mounts or the document root in the FileSelector widget.
Patches
Update to Contao 4.13.49.
Workarounds
None.
References
https://contao.org/en/security-advisories/directory-traversal-in-the-fileselector-widget
For more information
If you have any questions or comments about this advisory, open an issue in contao/contao.
Credits
Thanks to Jakob Steeg from usd AG for reporting this vulnerability.
Related
Alias · CVE (1)
- CVE-2024-45604 Contao is an Open Source CMS. vulnerability
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- https://github.com/contao/contao/security/advisories/GHSA-4p75-5p53-65m9 web
- https://nvd.nist.gov/vuln/detail/CVE-2024-45604 advisory
- https://github.com/contao/contao/commit/63409c6bdfd95197d9906e229d765b630d45742e web
- https://contao.org/en/security-advisories/directory-traversal-in-the-fileselector-widget web
- https://github.com/contao/contao package