Agnai vulnerable to Relative Path Traversal in Image Upload

Description

A vulnerability has been discovered in Agnai that permits attackers to upload image files at attacker-chosen location on the server. This issue can lead to image file uploads to unauthorized or unintended directories, including overwriting of existing images which may be used for defacement.

Recommendation

Update the agnai package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.0.330
• Patched version(s): 1.0.330

References

• GHSA-g54f-66mw-hv66
• CVE-2024-47171
• CWE-22
• CWE-35
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Agnai vulnerable to Remote Code Execution via JS Upload using Directory Traversal - CVE-2024-47169
• `@backstage/backend-common` vulnerable to path traversal through symlinks - CVE-2024-26150
• Agnai File Disclosure Vulnerability: JSON via Path Traversal - CVE-2024-47170
• Langchain Path Traversal vulnerability - CVE-2024-7774

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

agnai