CVE-2024-6433

Description

The application zips all the files in the folder specified by the user, which allows an attacker to read arbitrary files on the system by providing a crafted path. This vulnerability can be exploited by sending a request to the application with a malicious snapshot_path parameter.

Reserved 2024-07-01 | Published 2024-07-10 | Updated 2024-08-01 | Assigner @huntr_ai

Problem types

CWE-23 Relative Path Traversal

Product status

Any version before -
affected

References

huntr.com/bounties/7d0463dd-6373-4eb8-86fc-beac0a1391a5

cve.org (CVE-2024-6433)

nvd.nist.gov (CVE-2024-6433)

Download JSON