CVE-2024-52600: Statamic CMS has a Path Traversal in Asset Upload
5.3
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.33703%
CWE
Published
11/19/2024
Updated
11/19/2024
KEV Status
No
Technology
PHP
PHPTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| statamic/cms | composer | <= 5.16.0 | 5.17.0 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from insufficient path sanitization in asset handling components. Key evidence includes:
- The patch adds path traversal checks in Asset.php's path() setter (commit 400875b)
- AssetFolder.php's path() method was modified to throw on traversal patterns (commit 4cc2c9b)
- Tests demonstrate exploitation via URL-encoded '../' sequences (commit 0c07c10)
- FolderActionController required exception handling for path traversal detection These functions directly process user-controlled path inputs and were missing validation prior to patching, making them the attack surface for directory traversal.