CVE-2024-52600CWE-22

Statamic CMS has Path Traversal in Asset Upload

Medium · published November 19, 2024

CVSS v3.1
5.3
EPSS
1%
Percentile
46.8
In the wild
Unconfirmed
What it is

Statmatic is a Laravel and Git powered content management system (CMS). Prior to version 5.17.0, assets uploaded with appropriately crafted filenames may result in them being placed in a location different than what was configured. The issue affects front-end forms with `assets` fields and other places where assets can be uploaded, although users would need upload permissions anyway. Files can be uploaded so they would be located on the server in a different location, and potentially override existing files. Traversal outside an asset container is not possible. This path traversal vulnerability has been fixed in 5.17.0.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00576 · 46.8th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2024-11-19T16:30Z
EPSS history
Timeline
  • 19 NOV 16:30Z
    Statamic CMS has Path Traversal in Asset Upload
    cvelistv5