PT-2019-19979 · Iodine · Iodine
Boaz Segev
·
Published
2019-10-07
·
Updated
2025-11-29
·
CVE-2024-22050
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Iodine versions less than 0.7.33
Description
A path traversal issue in the static file service allows an unauthenticated, remote attacker to read files outside the public folder via malicious URLs. This can be achieved by drafting malicious URLs that cause the static file server to attempt a response containing data from files that shouldn't be normally accessible from the public folder.
Recommendations
For Iodine versions less than 0.7.33, upgrade to version 0.7.34 or later to resolve the issue.
As a temporary workaround, consider disabling the static file service and its
X-Sendfile support, and use an alternative method such as sending static files using nginx or a source code solution that sends the data dynamically.Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Iodine