CVE-2024-7741

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A vulnerability was found in wanglongcn ltcms 1.0.20 and classified as critical. This issue affects the function downloadFile of the file /api/file/downloadfile of the component API Endpoint. The manipulation of the argument file leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
wanglongcn	ltcms	1.0.20
wanglongcn	ltcms	1.0.20

References

https://github.com/DeepMountains/Mirage/blob/main/CVE14-2.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.274361Permissions Required, Third Party Advisory
https://vuldb.com/?id.274361Permissions Required, Third Party Advisory
https://vuldb.com/?submit.386433Third Party Advisory

Timeline

Published: Aug 13, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-77429.8A vulnerability was found in wanglongcn ltcms 1.0.20. It has been classified as critical. Affected is the function multiDownload of the file CVE-2024-77439.8A vulnerability was found in wanglongcn ltcms 1.0.20. It has been declared as critical. Affected by this vulnerability is the function downl CVE-2024-77446.5In WS_FTP Server versions before 8.8.8 (2022.0.8), an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnera CVE-2024-77458.1In WS_FTP Server versions before 8.8.8 (2022.0.8), a Missing Critical Step in Multi-Factor Authentication of the Web Transfer Module allows CVE-2024-77469.8Use of Default Credentials vulnerability in Tananaev Solutions Traccar Server on Administrator Panel modules allows Authentication Abuse.Thi CVE-2024-77476.5The Wallet for WooCommerce plugin for WordPress is vulnerable to incorrect conversion between numeric types in all versions up to, and inclu CVE-2024-77489.8A vulnerability, which was classified as critical, has been found in SourceCodester Accounts Manager App 1.0. This issue affects some unknow CVE-2024-77495.4A vulnerability, which was classified as problematic, was found in SourceCodester Accounts Manager App 1.0. Affected is an unknown function CVE-2024-77507.5A vulnerability has been found in SourceCodester Clinics Patient Management System 1.0 and classified as critical. Affected by this vulnerab CVE-2024-77517.5A vulnerability was found in SourceCodester Clinics Patient Management System 1.0 and classified as critical. Affected by this issue is some CVE-2024-77526.1A vulnerability was found in SourceCodester Clinics Patient Management System 1.0. It has been classified as problematic. This affects an un CVE-2024-77537.5A vulnerability was found in SourceCodester Clinics Patient Management System 1.0. It has been declared as problematic. This vulnerability a