PT-2025-1308 · Devdojo · Devdojo Voyager

Yaniv Nizry · Published 2025-01-30 · Updated 2025-09-22 · CVE-2024-55415

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions DevDojo Voyager versions 1.8.0 and earlier

Description The issue allows an attacker to gain access to sensitive information through path traversal at the "/admin/compass" API endpoint. This vulnerability is related to errors in handling relative paths to directories, which can be exploited by a remote attacker to impact the confidentiality, integrity, and availability of protected information.

Recommendations For DevDojo Voyager versions 1.8.0 and earlier, consider restricting access to the "/admin/compass" endpoint until a patch is available. As a temporary workaround, limit the exposure of sensitive information that could be accessed through this endpoint.

Exploit

Fix

Path traversal

Relative Path Traversal

Weakness Enumeration

CWE-22

CWE-23

Related Identifiers

BDU:2025-00932

CVE-2024-55415

GHSA-J63M-2VR6-FV7M

Affected Products

Devdojo Voyager

References · 26

• 🔥 https://sonarsource.com/blog/the-tainted-voyage-uncovering-voyagers-vulnerabilities · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-55415 · Security Note
• https://bdu.fstec.ru/vul/2025-00932 · Security Note
• https://osv.dev/vulnerability/GHSA-j63m-2vr6-fv7m · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-55415 · Vendor Advisory
• https://github.com/thedevdojo/voyager · Note
• https://github.com/thedevdojo/voyager?utm_source=Securitylabru · Note
• https://github.com/thedevdojo/voyager/blob/1.6/src/Http/Controllers/VoyagerCompassController.php#L213 · Note
• https://github.com/thedevdojo/voyager/blob/1.6/src/Http/Controllers/VoyagerCompassController.php#L44 · Note
• https://github.com/thedevdojo/voyager/blob/1.6/src/Http/Controllers/VoyagerMediaController.php#L238 · Note
• https://twitter.com/pravin_karthik/status/1885153608536383570 · Twitter Post
• https://securitylab.ru/news/555965.php · Note
• https://t.me/cvenotify/110250 · Telegram Post
• https://reddit.com/r/CVEWatch/comments/1nniefc/top_10_trending_cves_22092025 · Reddit Post
• https://t.me/true_secator/6678 · Telegram Post