GHSA-35p2-5vrh-m3p6

DevDojo Voyager Arbitrary File Write

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-55417

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	tcg/voyager	<= 1.8.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

DevDojo Voyager through version 1.8.0 is vulnerable to bypassing the file type verification when an authenticated user uploads a file via /admin/media/upload. An authenticated user can upload a web shell causing arbitrary code execution on the server.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-55417 advisory
https://github.com/thedevdojo/voyager package
https://github.com/thedevdojo/voyager/blob/1.6/src/Http/Controllers/VoyagerMediaController.php#L238 web
https://www.sonarsource.com/blog/the-tainted-voyage-uncovering-voyagers-vulnerabilities web