CVE-2024-6789

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A path traversal issue in API endpoint in M-Files Server before version 24.8.13981.0 and LTS 24.2.13421.15 SR2 and LTS 23.8.12892.0 SR6 allows authenticated user to read files

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
M-Files Corporation	M-Files Server	< 24.8.13981.0; >= LTS 24.2.0, < LTS 24.2.13421.15 SR2; >= LTS 23.8.0, < LTS 23.8.12892.0 SR6

References

Timeline

Published: Aug 27, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-67906.1Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver CVE-2024-67917.8A directory path traversal vulnerability exists when loading a vsmodel file in NI VeriStand that may result in remote code execution. Succe CVE-2024-67923.5The WP ULike WordPress plugin before 4.7.2.1 does not properly sanitize user display names when rendering on a public page.CVE-2024-67939.8A deserialization of untrusted data vulnerability exists in NI VeriStand DataLogging Server that may result in remote code execution. Succ CVE-2024-67949.8A deserialization of untrusted data vulnerability exists in NI VeriStand Waveform Streaming Server that may result in remote code execution CVE-2024-67959.8In Connex health portal released before8/30/2024, SQL injection vulnerabilities were found that could have allowed an unauthenticated attack CVE-2024-67969.1In Baxter Connex health portal released before 8/30/2024, an improper access control vulnerability has been found that could allow an unauth CVE-2024-67974.8The DL Robots.txt WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users suc CVE-2024-67984.8The DL Verification WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users s CVE-2024-67994.3The YITH Essential Kit for WooCommerce #1 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabilit CVE-2024-68009.8An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication with specific identity CVE-2024-68019.8A vulnerability, which was classified as critical, has been found in SourceCodester Online Student Management System 1.0. This issue affects