CVE-2024-43395

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-43395
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-43395.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-43395
Aliases
  • GHSA-hr3w-wc83-6923
Published
2024-08-16T20:15:32.325Z
Modified
2026-07-22T00:02:55.504307Z
Severity
  • 8.2 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N CVSS Calculator
Summary
CraftOS-PC 2's improperly sanitizied paths cause filesystem escape (Windows)
Details

CraftOS-PC 2 is a rewrite of the desktop port of CraftOS from the popular Minecraft mod ComputerCraft using C++ and a modified version of PUC Lua, as well as SDL for drawing. Prior to version 2.8.3, users of CraftOS-PC 2 on Windows can escape the computer folder and access files anywhere without permission or notice by obfuscating ..s to bypass the internal check preventing parent directory traversal. Version 2.8.3 contains a patch for this issue.

Database specific 
{
    "cwe_ids": [
        "CWE-22"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43395.json"
}
References

Affected packages

Git / github.com/mcjack123/craftos2

Affected ranges

Type
GIT
Repo
https://github.com/mcjack123/craftos2
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f7a88b905560df4366fb69f09b70f05984e05ad3
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.8.3"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v2.*
v2.0
v2.0.1
v2.0b1
v2.0b2
v2.0b3
v2.0p1
v2.1
v2.1.1
v2.1.2
v2.1.3
v2.2
v2.2.1
v2.2.2
v2.2.3
v2.2.3.1
v2.2.4
v2.2.5
v2.2.6
v2.2p1
v2.3-b1
v2.3.1
v2.3.3
v2.3.4
v2.4
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.4.5
v2.5
v2.5.1
v2.5.1.1
v2.5.2
v2.5.3
v2.5.4
v2.5.5
v2.6
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.6.5.1
v2.6.6
v2.6b1
v2.7
v2.7.1
v2.7.2
v2.7.3
v2.7.5
v2.8
v2.8.1
v2.8.2

Database specific

vanir_signatures_modified 
"2026-07-22T00:02:55Z"
vanir_signatures 
[
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 2452.0,
            "function_hash": "187433578299580145306642109853375458324"
        },
        "signature_version": "v1",
        "source": "https://github.com/mcjack123/craftos2/commit/f7a88b905560df4366fb69f09b70f05984e05ad3",
        "id": "CVE-2024-43395-0077aa94",
        "target": {
            "function": "fixpath_multiple",
            "file": "src/apis/fs.cpp"
        }
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 4536.0,
            "function_hash": "273904693800128402961099404048657727017"
        },
        "signature_version": "v1",
        "source": "https://github.com/mcjack123/craftos2/commit/f7a88b905560df4366fb69f09b70f05984e05ad3",
        "id": "CVE-2024-43395-055627b5",
        "target": {
            "function": "fixpath",
            "file": "src/util.cpp"
        }
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "274641065986861493931944361118110516660",
                "243127447954012934373223978929097399773",
                "60508595393080438642193737913203950688",
                "279390779259082966190313175761244718557",
                "152014606452699010475353067023870417088",
                "47637617716163722073269452218204013042",
                "104295684299284336315466602737754228864",
                "80552328844195429864577830064853554826",
                "258231163565502909885506813953530186468",
                "67702285917221727981497317684031878930",
                "160356767086227201432797148104656926061",
                "250789455524192239870210098609170681519",
                "88961817216461510884791034698615403638",
                "92549596921527658920415650733050214803",
                "220420304570213176958586440557662413774",
                "248471145127427063368056864679725589982",
                "82488391960623742338453528053568920902",
                "104295684299284336315466602737754228864",
                "80552328844195429864577830064853554826",
                "272851892218863803148779548381590042780",
                "109103830584069045066950057862254965439",
                "62093370498681752492213326610804508663",
                "56116089072357092879583094151633923132",
                "111018284050506486310787764946227637174",
                "333215510441780989721966317510285690029",
                "134578545841808856258673683320457484636",
                "164290232127181377386173839420007368456",
                "158934517111226625406050099301131071463",
                "192331238429444708120331188246881242233",
                "80552328844195429864577830064853554826"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/mcjack123/craftos2/commit/f7a88b905560df4366fb69f09b70f05984e05ad3",
        "id": "CVE-2024-43395-32567132",
        "target": {
            "file": "src/util.cpp"
        }
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 806.0,
            "function_hash": "102758044857064438662082452866707637436"
        },
        "signature_version": "v1",
        "source": "https://github.com/mcjack123/craftos2/commit/f7a88b905560df4366fb69f09b70f05984e05ad3",
        "id": "CVE-2024-43395-4fbd5e85",
        "target": {
            "function": "websocket_send",
            "file": "src/apis/http.cpp"
        }
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "296318301978311131138774083914243698052",
                "159196846599050105076552730983949330542",
                "172107685230943750607516291152884350275",
                "11369859617072739937164434142044811488",
                "198070854348716038495516804200567897928",
                "98648151277877124275710268446023637501",
                "286232431806346494343676855664328715755",
                "184839920318057655961417998438227826955",
                "80552328844195429864577830064853554826"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/mcjack123/craftos2/commit/f7a88b905560df4366fb69f09b70f05984e05ad3",
        "id": "CVE-2024-43395-70ab53b0",
        "target": {
            "file": "src/apis/fs.cpp"
        }
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "118266046896961865460753581066049831388",
                "320561129208685131143923441369139713357",
                "293549981437063159438213847260126903988",
                "336811123827747846845414598432220039129",
                "104460786859988581162096576289525084792",
                "298712391059339494830654767319651887682",
                "314501772673996424241366426489628014420",
                "63661782631314830049097612666113342145"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/mcjack123/craftos2/commit/f7a88b905560df4366fb69f09b70f05984e05ad3",
        "id": "CVE-2024-43395-855542e7",
        "target": {
            "file": "src/apis/http.cpp"
        }
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 1500.0,
            "function_hash": "179601009539522639876489510622768664827"
        },
        "signature_version": "v1",
        "source": "https://github.com/mcjack123/craftos2/commit/f7a88b905560df4366fb69f09b70f05984e05ad3",
        "id": "CVE-2024-43395-c4dadefa",
        "target": {
            "function": "fixpath_ro",
            "file": "src/util.cpp"
        }
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 942.0,
            "function_hash": "84931677287104986824465365084662744009"
        },
        "signature_version": "v1",
        "source": "https://github.com/mcjack123/craftos2/commit/f7a88b905560df4366fb69f09b70f05984e05ad3",
        "id": "CVE-2024-43395-cb4e805c",
        "target": {
            "function": "getMounts",
            "file": "src/util.cpp"
        }
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "244834394068306318771845632806443288968",
                "188419073704287832010268733948959835825",
                "314169664295718345625764672878215446612",
                "181472325108581864371518614268775064523",
                "62071565580232565671801072304697177038",
                "147946788279094776741120877879609310737",
                "98610740906732316952480901362595933850",
                "291046332258120159673498889257336969517",
                "324583531756321702492437223288223244928",
                "154684420384535246255024597439746524523"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/mcjack123/craftos2/commit/f7a88b905560df4366fb69f09b70f05984e05ad3",
        "id": "CVE-2024-43395-d41107cf",
        "target": {
            "file": "src/util.hpp"
        }
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-43395.json"