CVE-2024-52293

Craft is a content management system (CMS). Prior to 4.12.2 and 5.4.3, Craft is missing normalizePath in the function FileHelper::absolutePath could lead to Remote Code Execution on the server via twig SSTI. This is a sequel to CVE-2023-40035. This vulnerability is fixed in 4.12.2 and 5.4.3.

Score

CVSS 3.1 7.2 High

Status

Analyzed - security-advisories@github.com

Published

2024-11-13

Last modified

2024-11-13

Weaknesses

CWE-22

Affected products

• Cms (Craftcms)
• Craft Cms (Craftcms)

References

• https://github.com/craftcms/cms/commit/123e48a696de1e2f63ab519d4730eb3b87beaa58
• https://github.com/craftcms/cms/security/advisories/GHSA-f3cw-hg6r-chfv