CVE-2024-52600

Summary

CVE-2024-52600 is a newly disclosed vulnerability affecting the Statmatic Laravel and Git-powered content management system. Prior to version 5.17.0, this CMS failed to properly validate user-uploaded asset filenames, potentially leading to files being placed in unintended directories. This issue primarily impacts front-end forms with "assets" fields and other areas where users can upload files. An attacker would need upload permissions to exploit this path traversal vulnerability, which could result in overriding existing files. However, traversal beyond the asset container is not possible, and the vulnerability has been addressed in version 5.17.0.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.