CVE-2024-57186

MEDIUM EPSS 28.5%
Published Jun 10, 20251y ago · Modified Jun 17, 20261w ago
5.4 CVSS 3.1
Medium
Find Similar
Published Jun 10, 2025 1y ago
Last Modified Jun 17, 2026 1w ago

Description

In Erxes <1.6.2, an unauthenticated attacker can read arbitrary files from the system using a Path Traversal vulnerability in the /read-file endpoint handler.

CVSS Details

Base Score
5.4
Exploitability
2.8
Impact
2.5
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality Low
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
28.5% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-22 Path Traversal Resource Mgmt

Affected Products 1

VendorProductVersionRange
erxeserxes* <1.6.2

References 2

  • github.com https://github.com/erxes/erxes/commit/d626070a0fcd435ae29e689aca051ccfb440c2f3
    Patch
  • sonarsource.com https://www.sonarsource.com/blog/micro-services-major-headaches-detecting-vulnerabilities-in-erxes-microservices/
    ExploitThird Party Advisory

Remediation

  • github.com https://github.com/erxes/erxes/commit/d626070a0fcd435ae29e689aca051ccfb440c2f3
    Patch