CVE-2024-22050

HighCVSS 7.5/10Last modified Jul 14, 2026

Description

Path traversal in the static file service in Iodine less than 0.7.33 allows an unauthenticated, remote attacker to read files outside the public folder via malicious URLs.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
—	—	< 0.7.33

References

https://github.com/advisories/GHSA-85rf-xh54-whp3Patch, Third Party Advisory
https://github.com/boazsegev/iodine/commit/5558233fb7defda706b4f9c87c17759705949889Patch
https://github.com/boazsegev/iodine/security/advisories/GHSA-85rf-xh54-whp3Vendor Advisory
https://vulncheck.com/advisories/vc-advisory-GHSA-85rf-xh54-whp3Patch, Third Party Advisory
https://github.com/advisories/GHSA-85rf-xh54-whp3Patch, Third Party Advisory
https://github.com/boazsegev/iodine/commit/5558233fb7defda706b4f9c87c17759705949889Patch
https://github.com/boazsegev/iodine/security/advisories/GHSA-85rf-xh54-whp3Vendor Advisory
https://vulncheck.com/advisories/vc-advisory-GHSA-85rf-xh54-whp3Patch, Third Party Advisory

Timeline

Published: Jan 4, 2024
Last modified: Jul 14, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-220519.8CommonMarker versions prior to 0.23.4 are at risk of an integer overflow vulnerability. This vulnerability can result in possibly unauthenti CVE-2024-220527.5A null pointer dereference vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthen CVE-2024-220538.2A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x 22.x) and Ivanti Policy Secure allows an unauthenticated mal CVE-2024-220547.5A malformed discovery packet sent by a malicious actor with preexisting access to the network could interrupt the functionality of device ma CVE-2024-220587.8A buffer overflow allows a low privilege user on the local machine that has the EPM Agent installed to execute arbitrary code with elevated CVE-2024-220598.8A SQL injection vulnerability in web component of Ivanti Neurons for ITSM allows a remote authenticated user to read/modify/delete informati CVE-2024-22066.5An SSRF vulnerability exists in the gradio-app/gradio due to insufficient validation of user-supplied URLs in the `/proxy` route. Attackers CVE-2024-220604.9An unrestricted file upload vulnerability in web component of Ivanti Neurons for ITSM allows a remote, authenticated, high privileged user t CVE-2024-220619.8A Heap Overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows a remote unauthenticated attacker to ex CVE-2024-220628.8There is a permissions and access control vulnerability in ZXCLOUD IRAI.An attacker can elevate non-administrator permissions to administrat CVE-2024-220639.0The ZENIC ONE R58 products by ZTE Corporation have a command injection vulnerability. An authenticated attacker can exploit this vulnerabili CVE-2024-220646.5ZTE ZXUN-ePDG product, which serves as the network node of the VoWifi system, under by default configuration, uses a set of non-unique crypt