Jan path traversal vulnerability - @janhq/core - GHSA-5jqc-qj57-4hrc - CVE-2024-36857

Description

Jan v0.4.12 was discovered to contain an arbitrary file read vulnerability via the /v1/app/readFileSync interface.

Recommendation

No fix is available yet. Followings are affected versions:

<= 0.1.11

References

GHSA-5jqc-qj57-4hrc
CVE-2024-36857
CWE-22
CWE-31
CAPEC-310
OWASP 2021-A1
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for Jan path traversal vulnerability - @janhq/core - GHSA-5jqc-qj57-4hrc and gives you actionable findings to investigate.

Start a free scan

Related Issues

Jan path traversal vulnerability - @janhq/core - CVE-2024-36858
Jan path traversal vulnerability - CVE-2024-37273
Saltcorn Server allows logged-in users to delete arbitrary files because of a path traversal vulnerability - CVE-2024-47818
Agnai File Disclosure Vulnerability: JSON via Path Traversal - CVE-2024-47170

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

Exploiting Server Version Disclosure

CSRF, XXE, and 12 Other Security Acronyms Explained

See something that needs correcting? Let us knowUpdated August 14, 2024