CVE-2024-25154

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Improper URL validation leads to path traversal in FileCatalyst Direct 3.8.8 and earlier allowing an encoded payload to cause the web server to return files located outside of the web root which may lead to data leakage.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
Fortra	FileCatalyst	>= 3.8.6, < 3.8.9
fortra	filecatalyst	>= 3.8.6, < 3.8.9

References

https://filecatalyst.software/public/filecatalyst/Direct/3.8.9.90/whatsnew_direct.htmlRelease Notes
https://www.fortra.com/security/advisory/fi-2024-003Vendor Advisory
https://filecatalyst.software/public/filecatalyst/Direct/3.8.9.90/whatsnew_direct.htmlRelease Notes
https://www.fortra.com/security/advisory/fi-2024-003Vendor Advisory

Timeline

Published: Mar 13, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-251556.1In FileCatalyst Direct 3.8.8 and earlier through 3.8.6, the web server does not properly sanitize illegal characters in a URL which is then CVE-2024-251566.5A path traversal vulnerability exists in GoAnywhere MFT prior to 7.4.2 which allows attackers to circumvent endpoint-specific permission che CVE-2024-251576.5An authentication bypass vulnerability in GoAnywhere MFT prior to 7.6.0 allows Admin Users with access to the Agent Console to circumvent so CVE-2024-25168.8A vulnerability, which was classified as critical, was found in MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0. This affects an CVE-2024-251647.5iA Path Traversal vulnerability exists in iDURAR v2.0.0, that allows unauthenticated attackers to expose sensitive files via the download fu CVE-2024-251657.8A global-buffer-overflow vulnerability was found in SWFTools v0.9.2, in the function LineText at lib/swf5compiler.flex.CVE-2024-251666.1Cross Site Scripting vulnerability in 71CMS v.1.0.0 allows a remote attacker to execute arbitrary code via the uploadfile action parameter i CVE-2024-251676.1Cross Site Scripting vulnerability in eblog v1.0 allows a remote attacker to execute arbitrary code via a crafted script to the argument des CVE-2024-251686.3SQL injection vulnerability in snow snow v.2.0.0 allows a remote attacker to execute arbitrary code via the dataScope parameter of the syste CVE-2024-251699.8An issue in Mezzanine v6.0.0 allows attackers to bypass access control mechanisms in the admin panel via a crafted request.CVE-2024-25179.8A vulnerability has been found in MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0 and classified as critical. This vulnerability CVE-2024-251709.1An issue in Mezzanine v6.0.0 allows attackers to bypass access controls via manipulating the Host header.