PT-2024-32338 · Genie · Genie

Jmoritzc53 + 1 · Published 2024-05-09 · Updated 2025-10-25 · CVE-2024-4701

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Genie versions prior to 4.3.18

Description A path traversal issue exists in Genie that could lead to remote code execution. The issue stems from a vulnerability in the API that accepts file uploads via multipart/form-data. The API uses a user-supplied filename when writing files to disk, allowing a malicious actor to manipulate the filename to perform path traversal. This manipulation could allow writing files with user-specified names and contents to arbitrary locations on the file system where the Java process has write access. Users who do not store file attachments locally are not affected. The issue impacts Genie OSS instances that rely on the filesystem to store file attachments submitted to the application.

Recommendations Upgrade to Genie OSS version 4.3.18.

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-4701

GHSA-WPCV-5JGP-69F3

Affected Products

Genie

References · 16

• https://osv.dev/vulnerability/GHSA-wpcv-5jgp-69f3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-4701 · Security Note
• https://github.com/Netflix/genie/releases/tag/v4.3.18 · Note
• https://github.com/Netflix/genie/security/advisories/GHSA-wpcv-5jgp-69f3 · Note
• https://github.com/Netflix/genie/pull/1217 · Note
• https://github.com/Netflix/genie · Note
• https://github.com/Netflix/genie/commit/6bad017d8078c94e80d6c6fe8abd693910bf55cf · Note
• https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2024-001.md · Note
• https://reddit.com/r/CVEWatch/comments/1o9rw9p/top_10_trending_cves_18102025 · Reddit Post
• https://twitter.com/RobinsonPauli18/status/1978960308396765375 · Twitter Post
• https://twitter.com/BrutalSam_/status/1979062852284510424 · Twitter Post
• https://twitter.com/BrutalSam_/status/1981520822524379579 · Twitter Post
• https://twitter.com/XynikIT/status/1793268679351632325 · Twitter Post
• https://t.me/pentestingnews/46778 · Telegram Post
• https://biteyourconsole.net/2025/10/25/scena-ps5-netflix-nel-mirino-della-scena-hacking-spunta-un-nuovo-e-potenziale-exploit-userland-su-console-playstation-5/?fsp_sid=44642 · Reddit Post