CVE-2024-5548
- Source
- https://cve.org/CVERecord?id=CVE-2024-5548
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-5548.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-5548
- Published
- 2024-06-27T17:33:37Z
- Modified
- 2026-09-11T03:30:40Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- Directory Traversal in stitionai/devika
- Details
-
A directory traversal vulnerability exists in the stitionai/devika repository, specifically within the /api/download-project endpoint. Attackers can exploit this vulnerability by manipulating the 'project_name' parameter in a GET request to download arbitrary files from the system. This issue affects the latest version of the repository. The vulnerability arises due to insufficient input validation in the 'download_project' function, allowing attackers to traverse the directory structure and access files outside the intended directory. This could lead to unauthorized access to sensitive files on the server.
- Database specific
{ "cna_assigner": "@huntr_ai", "cwe_ids": [ "CWE-22" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/5xxx/CVE-2024-5548.json" }- References