CVE-2024-25466 React Native Document Picker Directory Traversal vulnerability
A local attacker can execute arbitrary code via a crafted script exploiting a directory traversal flaw in the React Native Document Picker library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-25466?
CVE-2024-25466 is a high-severity path traversal vulnerability in n/a, published on 16 Feb 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Directory Traversal vulnerability in React Native Document Picker before v.9.1.1 and fixed in v.9.1.1 allows a local attacker to execute arbitrary code via a crafted script to the Android library component.
Weakness: CWE-26
Which versions are affected by CVE-2024-25466?
4 open source packages ship an affected version, including react-native-document-picker. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
react-native-document-picker npm | All versions | 8.2.2 |
react-native-document-picker npm | All versions | 8.2.2 |
react-native-document-picker npm | From 9.0.0 | 9.1.1 |
react-native-document-picker npm | From 9.0.0 | 9.1.1 |
Products include React-Native-Documents Document Picker.
How do I fix CVE-2024-25466?
Upgrade react-native-document-picker to a fixed version for your release line: 8.2.2 or 9.1.1.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-25466 being exploited?
There is no known exploitation of CVE-2024-25466 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-pmgm-h3cc-m4hj, ROOT-APP-NPM-CVE-2024-25466.