CVE-2024-47818

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Saltcorn is an extensible, open source, no-code database application builder. A logged-in user with any role can delete arbitrary files on the filesystem by calling the `sync/clean_sync_dir` endpoint. The `dir_name` POST parameter is not validated/sanitized and is used to construct the `syncDir` that is deleted by calling `fs.rm`. This issue has been addressed in release version 1.0.0-beta16 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Oct 7, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-478198.7Umbraco, a free and open source .NET content management system, has a cross-site scripting vulnerability starting in version 14.0.0 and prio CVE-2024-47826.5A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to d CVE-2024-478203.5MarkUs, a web application for the submission and grading of student assignments, is vulnerable to path traversal in versions prior to 2.4.8.CVE-2024-478212.3pyLoad is a free and open-source Download Manager. The folder `/.pyload/scripts` has scripts which are run when certain actions are complete CVE-2024-478224.2Directus is a real-time API and App dashboard for managing SQL database content. Access tokens from query strings are not redacted and are p CVE-2024-478239.8Livewire is a full-stack framework for Laravel that allows for dynamic UI components without leaving PHP. In livewire/livewire prior to `2.1 CVE-2024-478248.7matrix-react-sdk is react-based software development kit for inserting a Matrix chat/VOIP client into a web page. Starting in version 3.18.0 CVE-2024-478258.7Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions CVE-2024-478266.1eLabFTW is an open source electronic lab notebook for research labs. A vulnerability in versions prior to 5.1.5 allows an attacker to inject CVE-2024-478274.8Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Due to a race condition in CVE-2024-478286.5ampache is a web based audio/video streaming application and file manager. A CSRF attack can be performed in order to delete objects (Playli CVE-2024-478296.5pnpm is a package manager. Prior to version 10.0.0, the path shortening function uses the md5 function as a path shortening compression func