CVE-2024-1485

CriticalCVSS 9.3/10Last modified Jun 17, 2026

Description

A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the `parent` or `plugin` keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed.

Metrics

CVSS 3.1 9.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Feb 14, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-14867.4Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices CVE-2024-14875.4The Photos and Files Contest Gallery WordPress plugin before 21.3.1 does not sanitize and escape some parameters, which could allow users wi CVE-2024-14887.3A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbo CVE-2024-14894.3The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and CVE-2024-14907.2An authenticated remote attacker with high privileges can exploit the OpenVPN configuration via the web-based management interface of a WAGO CVE-2024-14917.5The devices allow access to an unprotected endpoint that allows MPFS file system binary image upload without authentication. The MPFS2 file CVE-2024-14925.3The WPify Woo Czech plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the maybe_send_to CVE-2024-14936.5An issue was discovered in GitLab CE/EE affecting all versions starting from 9.2 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and s CVE-2024-14956.5An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.1 prior to 16.10.7, starting from 16.11 prior to 16.11.CVE-2024-14965.4The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the fifu_input_url parameter in all CVE-2024-14975.4The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form widget addr2_width attribute in al CVE-2024-14985.4The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Photo Stack Widget in all