CVE-2024-2563

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability has been found in PandaXGO PandaX up to 20240310 and classified as critical. This vulnerability affects the function DeleteImage of the file /apps/system/router/upload.go. The manipulation of the argument fileName with the input ../../../../../../../../../tmp/1.txt leads to path traversal: '../filedir'. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-257062 is the identifier assigned to this vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-24

Affected software

Vendor	Product	Versions
PandaXGO	PandaX	20240310
panda_xgo	pandax	< 20240310

References

https://github.com/PandaXGO/PandaX/pull/3Issue Tracking, Patch
https://vuldb.com/?ctiid.257062Permissions Required, VDB Entry
https://vuldb.com/?id.257062Permissions Required, VDB Entry
https://github.com/PandaXGO/PandaX/pull/3Issue Tracking, Patch
https://vuldb.com/?ctiid.257062Permissions Required, VDB Entry
https://vuldb.com/?id.257062Permissions Required, VDB Entry

Timeline

Published: Mar 17, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-256305.3Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who are using CRDs to store Cili CVE-2024-256315.3Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who have enabled an external kvs CVE-2024-256328.8eLabFTW is an open source electronic lab notebook for research labs. In the context of eLabFTW, an administrator is a user account with cert CVE-2024-256335.4eLabFTW is an open source electronic lab notebook for research labs. In an eLabFTW system, one can configure who is allowed to create new us CVE-2024-256346.5alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, an attacker can access data from other organizers. The att CVE-2024-256358.8alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, organization owners can view the generated API KEY and USE CVE-2024-256368.8Misskey is an open source, decentralized social media platform with ActivityPub support. Prior to version 2024.2.0, when fetching remote Act CVE-2024-256375.4October is a self-hosted CMS platform based on the Laravel PHP Framework. The X-October-Request-Handler Header does not sanitize the AJAX ha CVE-2024-256388.9dnsjava is an implementation of DNS in Java. Records in DNS replies are not checked for their relevance to the query, allowing an attacker t CVE-2024-256397.5Khoj is an application that creates personal AI agents. The Khoj Obsidian, Desktop and Web clients inadequately sanitize the AI model's resp CVE-2024-25647.3A vulnerability was found in PandaXGO PandaX up to 20240310 and classified as critical. This issue affects the function ExportUser of the fi CVE-2024-256405.4Iris is a web collaborative platform that helps incident responders share technical details during investigations. A stored Cross-Site Scrip