PT-2025-1307 · Devdojo · Devdojo Voyager

Yaniv Nizry · Published 2025-01-30 · Updated 2025-02-06 · CVE-2024-55416

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions DevDojo Voyager versions 1.8.0 and earlier

Description The issue allows for reflected XSS via the "/admin/compass" API endpoint. By manipulating an authenticated user to click on a link, arbitrary JavaScript code can be executed.

Recommendations DevDojo Voyager versions 1.8.0 and earlier: Update to a version later than 1.8.0 to resolve the issue. As a temporary workaround, consider restricting access to the "/admin/compass" API endpoint until a patch is available.

Exploit

Fix

Path traversal

XSS

Relative Path Traversal

Weakness Enumeration

CWE-22

CWE-79

CWE-23

Related Identifiers

BDU:2025-00931

BDU:2025-00932

CVE-2024-55416

GHSA-MM49-4F2G-C3WF

Affected Products

Devdojo Voyager

References · 21

• 🔥 https://sonarsource.com/blog/the-tainted-voyage-uncovering-voyagers-vulnerabilities · Exploit
• https://bdu.fstec.ru/vul/2025-00931 · Security Note
• https://bdu.fstec.ru/vul/2025-00932 · Security Note
• https://osv.dev/vulnerability/CVE-2024-55416 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-55416 · Security Note
• https://osv.dev/vulnerability/GHSA-mm49-4f2g-c3wf · Vendor Advisory
• https://github.com/thedevdojo/voyager · Note
• https://github.com/thedevdojo/voyager?utm_source=Securitylabru · Note
• https://github.com/thedevdojo/voyager/blob/1.6/src/Http/Controllers/VoyagerCompassController.php#L44 · Note
• https://github.com/thedevdojo/voyager/blob/1.6/resources/views/master.blade.php#L132 · Note
• https://github.com/thedevdojo/voyager/blob/1.6/src/Http/Controllers/VoyagerMediaController.php#L238 · Note
• https://twitter.com/pravin_karthik/status/1885153608536383570 · Twitter Post
• https://securitylab.ru/news/555965.php · Note
• https://twitter.com/CVEnew/status/1884977434845430263 · Twitter Post
• https://t.me/true_secator/6678 · Telegram Post