CVE-2024-52306

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-52306
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-52306.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-52306
Aliases
Published
2024-11-13T15:15:38.301Z
Modified
2026-07-15T01:49:20.647923415Z
Severity
  • 7.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
Summary
FileManager Deserialization of Untrusted Data
Details

FileManager provides a Backpack admin interface for files and folder. Prior to 3.0.9, deserialization of untrusted data from the mimes parameter could lead to remote code execution. This vulnerability is fixed in 3.0.9.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52306.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-502"
    ]
}
References

Affected packages

Git / github.com/laravel-backpack/filemanager

Affected ranges

Type
GIT
Repo
https://github.com/laravel-backpack/filemanager
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e28eb6e921151149c55933a796c4178f366bb1d0
Introduced
9cd439c472401ced20af9159a35a8039d960c546
Fixed
2830498b85e05fb3c92179053b4d7c4a0fdb880b
Database specific 
{
    "cpe": "cpe:2.3:a:backpackforlaravel:filemanager:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.0.2"
        },
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.0.9"
        }
    ]
}

Affected versions

1.*
1.0.0
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
2.*
2.0.0
2.0.1
3.*
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-52306.json"