CVE-2024-55602

HighCVSS 8.5/10Last modified Jun 17, 2026

Description

PwnDoc is a penetration test report generator. Prior to commit 1d4219c596f4f518798492e48386a20c6e9a2fe6, an authenticated user who is able to update and download templates can inject path traversal (`../`) sequences into the file extension property to read arbitrary files on the system. Commit 1d4219c596f4f518798492e48386a20c6e9a2fe6 contains a patch for the issue.

Metrics

CVSS 3.1 8.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
pwndoc	pwndoc	< 1d4219c596f4f518798492e48386a20c6e9a2fe6

References

Timeline

Published: Dec 10, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-556036.5Kanboard is project management software that focuses on the Kanban methodology. In affected versions sessions are still usable even though t CVE-2024-556044.3Appsmith is a platform to build admin panels, internal tools, and dashboards. Users invited as "App Viewer" should not have access to develo CVE-2024-556057.5Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.8, a larg CVE-2024-55614.8The Popup Maker WordPress plugin before 1.19.1 does not sanitise and escape some of its settings, which could allow high privilege users su CVE-2024-556265.5Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.8, a larg CVE-2024-556277.5Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.8, a spec CVE-2024-556287.5Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.8 CVE-2024-556297.5Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.8, TCP st CVE-2024-55634.8Due to an incomplete implementation, reCaptcha is not applied to certain authentication flows even when the reCaptcha option is enabled. Thi CVE-2024-556305.5Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Joplin's CVE-2024-556317.8An engine link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations CVE-2024-556327.8A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected instal