CVE-2024-45604CWE-22

Directory traversal in the file selector widget in contao/core-bundle

Medium · published September 17, 2024

CVSS v3.1
4.3
EPSS
0%
Percentile
35.9
In the wild
Unconfirmed
What it is

Contao is an Open Source CMS. In affected versions authenticated users in the back end can list files outside the document root in the file selector widget. Users are advised to update to Contao 4.13.49. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00427 · 35.9th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2024-09-17T19:56Z
EPSS history
Timeline
  • 17 SEP 19:56Z
    Directory traversal in the file selector widget in contao/core-bundle
    cvelistv5