CVE-2024-42485

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Filament Excel enables excel export for Filament admin resources. The export download route `/filament-excel/{path}` allowed downloading any file without login when the webserver allows `../` in the URL. Patched with Version v2.3.3.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
pxlrbt	filament-excel	>= 2.0.0-alpha, < 2.3.3; < 1.1.14
filament	excel_export	>= 2.0.0-alpha, < 2.3.3; < 1.1.14

References

Timeline

Published: Aug 12, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-424867.2Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In versions on the 1.15.x branch prior to 1.15.8 CVE-2024-424874.3Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In the 1.15 branch prior to 1.15.8 and the 1.16 b CVE-2024-424886.8Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.14.14 and 1.15.8, a race cond CVE-2024-424898.8Pro Macros provides XWiki rendering macros. Missing escaping in the Viewpdf macro allows any user with view right on the `CKEditor.HTMLConve CVE-2024-42498.8A vulnerability was found in Tenda i21 1.0.0.14(4656). It has been classified as critical. Affected is the function formwrlSSIDget of the fi CVE-2024-424907.5authentik is an open-source Identity Provider. Several API endpoints can be accessed by users without correct authentication/authorization. CVE-2024-424915.7Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.24.3, 20.9.3, and 21.4.3 of Asterisk and versions 18.9-cert12 CVE-2024-424926.7Uncontrolled search path element in some BIOS and System Firmware Update Package for Intel(R) Server M50FCP family before version R01.02.000 CVE-2024-424935.3Dorsett Controls InfoScan is vulnerable due to a leak of possible sensitive information through the response headers and the rendered Java CVE-2024-424947.5Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a a feature that could enable sub accounts or attackers to view an CVE-2024-424957.5Credentials to access device configuration were transmitted using an unencrypted protocol. These credentials would allow read-only access to CVE-2024-424962.4Smart-tab Android app installed April 2023 or earlier contains an issue with plaintext storage of a password. If this vulnerability is explo