CVE-2024-52293

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Craft is a content management system (CMS). Prior to 4.12.2 and 5.4.3, Craft is missing normalizePath in the function FileHelper::absolutePath could lead to Remote Code Execution on the server via twig SSTI. This is a sequel to CVE-2023-40035. This vulnerability is fixed in 4.12.2 and 5.4.3.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
craftcms	cms	>= 4.0.0-RC1, < 4.12.2; >= 5.0.0-RC1, < 5.4.3
craftcms	craft_cms	<= 4.0.0-RC1; < 4.12.2; <= 5.0.0-RC1; < 5.4.3

References

https://github.com/craftcms/cms/commit/123e48a696de1e2f63ab519d4730eb3b87beaa58Patch
https://github.com/craftcms/cms/security/advisories/GHSA-f3cw-hg6r-chfvExploit, Vendor Advisory

Timeline

Published: Nov 13, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-522944.3Khoj is a self-hostable artificial intelligence app. Prior to version 1.29.10, an Insecure Direct Object Reference (IDOR) vulnerability in t CVE-2024-522959.8DataEase is an open source data visualization analysis tool. Prior to 2.10.2, DataEase allows attackers to forge jwt and take over services.CVE-2024-522966.5libosdp is an implementation of IEC 60839-11-5 OSDP (Open Supervised Device Protocol) and provides a C library with support for C++, Rust an CVE-2024-522977.5Tolgee is an open-source localization platform. Tolgee 3.81.1 included the all configuration properties in the PublicConfiguratioDTO publicl CVE-2024-522987.5macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. The PDF Viewer macro allows an attacker to view any attachment using t CVE-2024-522997.5macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Any user with view right on XWiki.PDFViewerService can access any atta CVE-2024-52305.3A vulnerability has been found in EnvaySoft FleetCart up to 4.1.1 and classified as problematic. Affected by this vulnerability is an unknow CVE-2024-523009.0macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. The width parameter of the PDF viewer macro isn't properly escaped, al CVE-2024-523017.5Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special craft CVE-2024-523028.7common-user-management is a robust Spring Boot application featuring user management services designed to control user access dynamically. T CVE-2024-523037.5aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions starting with 3.10.6 and prior to 3.10.11, a mem CVE-2024-523047.5aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines