CVE-2024-52293 — Craft has a Potential Remote Code Execution via missing path normalization & Twig SSTI
Craft is a content management system (CMS). Prior to 4.12.2 and 5.4.3, Craft is missing normalizePath in the function FileHelper::absolutePath could lead to Remote Code Executio…
Published: 2024-11-13 · CVSS: 7.2 · CVSS 3.1
Craft is a content management system (CMS). Prior to 4.12.2 and 5.4.3, Craft is missing normalizePath in the function FileHelper::absolutePath could lead to Remote Code Execution on the server via twig SSTI. This is a sequel to CVE-2023-40035. This vulnerability is fixed in 4.12.2 and 5.4.3.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7