CVE-2024-8055

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Vanna v0.6.3 is vulnerable to SQL injection via Snowflake database in its file staging operations using the `PUT` and `COPY` commands. This vulnerability allows unauthenticated remote users to read arbitrary local files on the victim server, such as `/etc/passwd`, by exploiting the exposed SQL queries through a Python Flask API.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Mar 20, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-80566.1The MM-Breaking News WordPress plugin through 0.7.9 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an at CVE-2024-80574.3In version 0.4.1 of danswer-ai/danswer, a vulnerability exists where a basic user can create credentials and link them to an existing connec CVE-2024-80587.6An improper parsing vulnerability was reported in the FileZ client that could allow a crafted file in the FileZ directory to read arbitrary CVE-2024-80594.3IPMI credentials may be captured in XCC audit log entries when the account username length is 16 characters.CVE-2024-80617.5In version 3.23.0 of aimhubio/aim, certain methods that request data from external servers do not have set timeouts, causing the server to w CVE-2024-80627.5A vulnerability in the typeahead endpoint of h2oai/h2o-3 version 3.46.0 allows for a denial of service. The endpoint performs a `HEAD` reque CVE-2024-80637.5A divide by zero vulnerability exists in ollama/ollama version v0.3.3. The vulnerability occurs when importing GGUF models with a crafted ty CVE-2024-80658.1A Cross-Site Request Forgery (CSRF) vulnerability in version v1.4.1 of danswer-ai/danswer allows attackers to perform unauthorized actions i CVE-2024-80668.8The File Manager Pro – Filester plugin for WordPress is vulnerable to arbitrary file uploads due to missing validation in the 'fsConnector' CVE-2024-80675.8In versions of Helix Core prior to 2024.1 Patch 2 (2024.1/2655224) a Windows ANSI API Unicode "best fit" argument injection was identified.CVE-2024-80688.0Privilege escalation to NetworkService Account access in Citrix Session Recording when an attacker is an authenticated user in the same Wind CVE-2024-80698.0Limited remote code execution with privilege of a NetworkService Account access in Citrix Session Recording if the attacker is an authentica