CVE-2024-52600 Statamic CMS has Path Traversal in Asset Upload
Attackers with upload permissions can use crafted filenames to place assets in unintended server locations, potentially overriding existing files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-52600?
CVE-2024-52600 is a medium-severity path traversal vulnerability in statamic cms, published on 19 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Statmatic is a Laravel and Git powered content management system (CMS). Prior to version 5.17.0, assets uploaded with appropriately crafted filenames may result in them being placed in a location different than what was configured. The issue affects front-end forms with `assets` fields and other places where assets can be uploaded, although users would need upload permissions anyway. Files can be uploaded so they would be located on the server in a different location, and potentially override existing files. Traversal outside an asset container is not possible. This path traversal vulnerability has been fixed in 5.17.0.
Weakness: CWE-22
Which versions are affected by CVE-2024-52600?
2 open source packages ship an affected version, including statamic/cms.
| Package | Affected | Fixed in |
|---|---|---|
statamic/cms Packagist | All versions | 5.17.0 |
statamic/cms Packagist | All versions | 5.17.0 |
How do I fix CVE-2024-52600?
Upgrade statamic/cms to 5.17.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-52600 being exploited?
There is no known exploitation of CVE-2024-52600 in the wild and no public exploit code.
Sources
Also known as GHSA-p7f6-8mcm-fwv3.