CVE-2024-56142

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. A vulnerability has been discovered that could allow an attacker to acquire disk access with privileges equivalent to those of pghoard, allowing for unintended path traversal. Depending on the permissions/privileges assigned to pghoard, this could allow disclosure of sensitive information. This issue has been addressed in releases after 2.2.2a. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Dec 17, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-561438.2Strapi is an open-source headless content management system. In versions from 5.0.0 to before 5.5.2, the lookup operator provided by the doc CVE-2024-561445.4librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to a stored XSS on the parameters (Repla CVE-2024-561459.8Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affecte CVE-2024-56155.3The Open Graph plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.11.2 via the 'op CVE-2024-561569.0Halo is an open source website building tool. Prior to version 2.20.13, a vulnerability in Halo allows attackers to bypass file type validat CVE-2024-561576.3iTop is an web based IT Service Management tool. Prior to versions 3.1.3 and 3.2.1, by filling malicious code in a CSV content, a cross-site CVE-2024-561589.8XWiki is a generic wiki platform. It's possible to execute any SQL query in Oracle by using the function like DBMS_XMLGEN or DBMS_XMLQUERY. CVE-2024-561595.3Astro is a web framework for content-driven websites. A bug in the build process allows any unauthenticated user to read parts of the server CVE-2024-56164.3A Cross-Site Request Forgery (CSRF) vulnerability exists in mudler/LocalAI versions up to and including 2.15.0, which allows attackers to tr CVE-2024-561617.2Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malic CVE-2024-561695.3A validation integrity issue was discovered in Fort through 1.6.4 before 2.0.0. RPKI Relying Parties (such as Fort) are supposed to maintain CVE-2024-561705.3A validation integrity issue was discovered in Fort through 1.6.4 before 2.0.0. RPKI manifests are listings of relevant files that clients a