CVE-2024-5926
Path Traversal in stitionai/devika
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Path Traversal in stitionai/devika
| Assigner | @huntr_ai |
| Reserved | 2024-06-12 |
| Published | 2024-06-30 |
| Updated | 2024-08-01 |
A path traversal vulnerability in the get-project-files functionality of stitionai/devika allows attackers to read arbitrary files from the filesystem and cause a Denial of Service (DoS). This issue is present in all versions of the application. The vulnerability arises due to insufficient path sanitization for the 'project-name' parameter, enabling attackers to specify paths that traverse the filesystem. By setting 'project-name' to the root directory, an attacker can cause the application to attempt to read the entire filesystem, leading to a DoS condition.
| CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
CWE-29 Path Traversal: '\..\filename'
https://huntr.com/bounties/19af24fe-9b90-4638-8fbc-b18def6985d7
