PT-2025-5881 · Unknown · Webfilesys

Published 2025-02-06 · Updated 2025-05-29 · CVE-2024-53586

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions WebFileSys version 2.31.0

Description An issue in the relPath parameter allows attackers to perform directory traversal via a crafted HTTP request. By injecting traversal payloads into the relPath parameter, attackers can manipulate file paths and gain unauthorized access to sensitive files, potentially exposing data outside the intended directory.

Recommendations For WebFileSys version 2.31.0, consider restricting access to the relPath parameter to minimize the risk of exploitation. As a temporary workaround, avoid using the relPath parameter in HTTP requests until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-53586

Affected Products

Webfilesys

References · 7

• 🔥 https://exploit-db.com/exploits/52185 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-53586 · Security Note
• https://packetstorm.news/files/id/189017 · Note
• https://t.me/cvedetector/17434 · Telegram Post
• https://twitter.com/ExCraft_labs/status/1927968556521488520 · Twitter Post
• https://twitter.com/CVEnew/status/1887619863046463629 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1887688191794151829 · Twitter Post