PT-2025-1308 · Devdojo · Devdojo Voyager

Yaniv Nizry · CVE-2024-55415 · Published 2025-01-30 · Updated 2025-09-22

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions DevDojo Voyager versions 1.8.0 and earlier

Description The issue allows an attacker to gain access to sensitive information through path traversal at the "/admin/compass" API endpoint. This vulnerability is related to errors in handling relative paths to directories, which can be exploited by a remote attacker to impact the confidentiality, integrity, and availability of protected information.

Recommendations For DevDojo Voyager versions 1.8.0 and earlier, consider restricting access to the "/admin/compass" endpoint until a patch is available. As a temporary workaround, limit the exposure of sensitive information that could be accessed through this endpoint.

Exploit

Fix

Relative Path Traversal

Path traversal

Weakness Enumeration

CWE-23

CWE-22

Related Identifiers

BDU:2025-00932

CVE-2024-55415

GHSA-J63M-2VR6-FV7M

Affected Products

Devdojo Voyager

References · 27

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/55xxx/CVE-2024-55415.json · Exploit
• 🔥 https://sonarsource.com/blog/the-tainted-voyage-uncovering-voyagers-vulnerabilities · Exploit
• https://osv.dev/vulnerability/CVE-2024-55415 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-55415 · Security Note
• https://osv.dev/vulnerability/GHSA-j63m-2vr6-fv7m · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-00932 · Security Note
• https://github.com/thedevdojo/voyager · Note
• https://github.com/thedevdojo/voyager?utm_source=Securitylabru · Note
• https://github.com/thedevdojo/voyager/blob/1.6/src/Http/Controllers/VoyagerCompassController.php#L44 · Note
• https://github.com/thedevdojo/voyager/blob/1.6/src/Http/Controllers/VoyagerCompassController.php#L213 · Note
• https://github.com/thedevdojo/voyager/blob/1.6/src/Http/Controllers/VoyagerMediaController.php#L238 · Note
• https://t.me/true_secator/6678 · Telegram Post
• https://reddit.com/r/CVEWatch/comments/1mxxkel/top_10_trending_cves_23082025 · Reddit Post
• https://twitter.com/y1659rsgh/status/1885944654484435301 · Twitter Post
• https://t.me/cvedetector/16802 · Telegram Post