CVE-2024-2563

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability has been found in PandaXGO PandaX up to 20240310 and classified as critical. This vulnerability affects the function DeleteImage of the file /apps/system/router/upload.go. The manipulation of the argument fileName with the input ../../../../../../../../../tmp/1.txt leads to path traversal: '../filedir'. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-257062 is the identifier assigned to this vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-24

Affected software

No affected versions have been published.

Timeline

Published
Mar 17, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-256305.3Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who are using CRDs to store CiliCVE-2024-256315.3Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who have enabled an external kvsCVE-2024-256328.8eLabFTW is an open source electronic lab notebook for research labs. In the context of eLabFTW, an administrator is a user account with certCVE-2024-256335.4eLabFTW is an open source electronic lab notebook for research labs. In an eLabFTW system, one can configure who is allowed to create new usCVE-2024-256346.5alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, an attacker can access data from other organizers. The attCVE-2024-256358.8alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, organization owners can view the generated API KEY and USECVE-2024-256368.8Misskey is an open source, decentralized social media platform with ActivityPub support. Prior to version 2024.2.0, when fetching remote ActCVE-2024-256375.4October is a self-hosted CMS platform based on the Laravel PHP Framework. The X-October-Request-Handler Header does not sanitize the AJAX haCVE-2024-256388.9dnsjava is an implementation of DNS in Java. Records in DNS replies are not checked for their relevance to the query, allowing an attacker tCVE-2024-256397.5Khoj is an application that creates personal AI agents. The Khoj Obsidian, Desktop and Web clients inadequately sanitize the AI model's respCVE-2024-25647.3A vulnerability was found in PandaXGO PandaX up to 20240310 and classified as critical. This issue affects the function ExportUser of the fiCVE-2024-256405.4Iris is a web collaborative platform that helps incident responders share technical details during investigations. A stored Cross-Site Scrip