PT-2025-1306 · Devdojo · Devdojo Voyager

Yaniv Nizry · Published 2025-01-28 · Updated 2025-05-23 · CVE-2024-55417

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions DevDojo Voyager versions 1.8.0 and earlier

Description The issue allows an authenticated user to bypass file type verification when uploading a file via the "/admin/media/upload" endpoint. This can lead to the upload of a web shell, resulting in arbitrary code execution on the server. The vulnerability is being actively exploited.

Recommendations For DevDojo Voyager versions 1.8.0 and earlier, as a temporary workaround, consider disabling the file upload functionality via the "/admin/media/upload" endpoint until a patch is available. Restrict access to this endpoint to minimize the risk of exploitation. Avoid using this feature until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2025-00930

CVE-2024-55417

GHSA-35P2-5VRH-M3P6

Affected Products

Devdojo Voyager

References · 23

• 🔥 https://sonarsource.com/blog/the-tainted-voyage-uncovering-voyagers-vulnerabilities · Exploit
• https://osv.dev/vulnerability/GHSA-35p2-5vrh-m3p6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-55417 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-00930 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-55417 · Security Note
• https://github.com/thedevdojo/voyager · Note
• https://github.com/thedevdojo/voyager?utm_source=Securitylabru · Note
• https://github.com/thedevdojo/voyager/blob/1.6/src/Http/Controllers/VoyagerMediaController.php#L238 · Note
• https://t.me/cvedetector/16805 · Telegram Post
• https://twitter.com/transilienceai/status/1886879866013814870 · Twitter Post
• https://twitter.com/pravin_karthik/status/1885153608536383570 · Twitter Post
• https://securitylab.ru/news/555965.php · Note
• https://twitter.com/fridaysecurity/status/1885506962969731447 · Twitter Post
• https://t.me/true_secator/6678 · Telegram Post
• https://twitter.com/securityRSS/status/1885086526654021808 · Twitter Post