SB2024111364 - Files or Directories Accessible to External Parties in Craft CMS

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2024111364

SB2024111364 - Files or Directories Accessible to External Parties in Craft CMS

Published: November 13, 2024 Updated: June 16, 2026

Security Bulletin ID SB2024111364
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Files or Directories Accessible to External Parties (CVE-ID: CVE-2024-52292)

CWE-ID: CWE-552 - Files or Directories Accessible to External Parties

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to files or directories accessible to external parties in the mail notification template functionality when rendering a crafted system notification template that calls the dataUrl function with an absolute file path. A remote user can modify a system notification template and trigger a corresponding system email to disclose sensitive information.

Exploitation requires write access to system notification templates and the ability to trigger the related notification email.


Remediation

Install update from vendor's website.

References