CVE-2024-49381 Plenti arbitrary file deletion vulnerability
An attacker can delete arbitrary files via the /postLocal endpoint in Plenti, leading to information loss.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-49381?
CVE-2024-49381 is a high-severity path traversal vulnerability in plentico plenti, published on 25 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Plenti, a static site generator, has an arbitrary file deletion vulnerability in versions prior to 0.7.2. The `/postLocal` endpoint is vulnerable to an arbitrary file write deletion when a plenti user serves their website. This issue may lead to information loss. Version 0.7.2 fixes the vulnerability.
Which versions are affected by CVE-2024-49381?
3 open source packages ship an affected version, including github.com/plentico/plenti. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/plentico/plenti Go | All versions | 0.7.2 |
github.com/plentico/plenti Go | All versions | 0.7.2 |
github.com/plentico/plenti Go | All versions | 0.7.2 |
Products include Plenti Plenti.
How do I fix CVE-2024-49381?
Upgrade github.com/plentico/plenti to 0.7.2 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-49381 being exploited?
There is no known exploitation of CVE-2024-49381 in the wild and no public exploit code.
Other vulnerabilities in plentico plenti
Sources
Also known as GHSA-6h8w-hrfp-pffx, GO-2024-3214.