CVE-2024-49381

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Plenti, a static site generator, has an arbitrary file deletion vulnerability in versions prior to 0.7.2. The `/postLocal` endpoint is vulnerable to an arbitrary file write deletion when a plenti user serves their website. This issue may lead to information loss. Version 0.7.2 fixes the vulnerability.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-74CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Oct 25, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-493824.3Excessive attack surface in archive-server service due to binding to an unrestricted IP address. The following products are affected: AcroniCVE-2024-493834.3Excessive attack surface in acep-importer service due to binding to an unrestricted IP address. The following products are affected: AcronisCVE-2024-493844.3Excessive attack surface in acep-collector service due to binding to an unrestricted IP address. The following products are affected: AcroniCVE-2024-493855.5Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis True Image (Windows) beforCVE-2024-493865.7Sensitive information disclosure due to spell-jacking. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0CVE-2024-493877.5Cleartext transmission of sensitive information in acep-collector service. The following products are affected: Acronis Cyber Protect 16 (LiCVE-2024-493889.1Sensitive information manipulation due to improper authorization. The following products are affected: Acronis Cyber Protect 16 (Linux, WindCVE-2024-493897.8Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Files (Windows) before buiCVE-2024-49395.4The Weaver Xtreme Theme Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's div shortcode in all versCVE-2024-493907.3Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Files (Windows) before buiCVE-2024-493917.3Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Files (Windows) before buiCVE-2024-493924.8Stored cross-site scripting (XSS) vulnerability on enrollment invitation page. The following products are affected: Acronis Cyber Files (Win