CVE-2024-5548

Source
https://nvd.nist.gov/vuln/detail/CVE-2024-5548
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-5548.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-5548
Published
2024-06-27T18:15:20Z
Modified
2025-01-14T19:46:52Z
Summary
[none]
Details

A directory traversal vulnerability exists in the stitionai/devika repository, specifically within the /api/download-project endpoint. Attackers can exploit this vulnerability by manipulating the 'projectname' parameter in a GET request to download arbitrary files from the system. This issue affects the latest version of the repository. The vulnerability arises due to insufficient input validation in the 'downloadproject' function, allowing attackers to traverse the directory structure and access files outside the intended directory. This could lead to unauthorized access to sensitive files on the server.

References

Affected packages

Git / github.com/stitionai/devika

Affected ranges

Type
GIT
Repo
https://github.com/stitionai/devika
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
Fixed