CVE-2024-7062

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Nimble Commander suffers from a privilege escalation vulnerability due to the server (info.filesmanager.Files.PrivilegedIOHelperV2) performing improper/insufficient validation of a client’s authorization before executing an operation. Consequently, it is possible to execute system-level commands as the root user, such as changing permissions and ownership, obtaining a handle (file descriptor) of an arbitrary file, and terminating processes, among other operations.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
Nimble Commander	Nimble Commander	<= v1.6.0, Build 4087
michaelkazakov	nimble_commander	<= 1.6.0

References

https://pentraze.com/vulnerability-reports/CVE-2024-7062/Exploit, Mitigation, Third Party Advisory
https://pentraze.com/vulnerability-reports/CVE-2024-7062/Exploit, Mitigation, Third Party Advisory

Timeline

Published: Jul 26, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-70634.3The ElementsKit Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.6 via the CVE-2024-70645.4The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and incl CVE-2024-70654.3A vulnerability was found in Spina CMS up to 2.18.0. It has been classified as problematic. Affected is an unknown function of the file /adm CVE-2024-70669.8A vulnerability was found in F-logic DataCube3 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functiona CVE-2024-70678.8A vulnerability was found in kirilkirkov Ecommerce-Laravel-Bootstrap up to 1f1097a3448ce8ec53e034ea0f70b8e2a0e64a87. It has been rated as cr CVE-2024-70684.6A vulnerability classified as problematic has been found in SourceCodester Insurance Management System 1.0. This affects an unknown part of CVE-2024-70697.5A vulnerability, which was classified as critical, has been found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0. This CVE-2024-70719.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE - 564 - SQL Injection: Hibernate vulnerability in CVE-2024-70736.5A server-side request forgery (SSRF) vulnerability exists in multiple WSO2 products due to improper input validation in SOAP admin services.CVE-2024-70746.8An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user input in SOAP admin services. A m CVE-2024-70754.6The user search function within the management console fails to properly encode user-supplied input before rendering it in the browser. This CVE-2024-70769.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Semtek Informatics Software Consulting