CVE-2024-5926

Severity CVSS v4.0:

Pending analysis

Type:

Unavailable / Other

Publication date:

30/06/2024

Last modified:

10/07/2025

Description

A path traversal vulnerability in the get-project-files functionality of stitionai/devika allows attackers to read arbitrary files from the filesystem and cause a Denial of Service (DoS). This issue is present in all versions of the application. The vulnerability arises due to insufficient path sanitization for the &#39;project-name&#39; parameter, enabling attackers to specify paths that traverse the filesystem. By setting &#39;project-name&#39; to the root directory, an attacker can cause the application to attempt to read the entire filesystem, leading to a DoS condition.

Impact

Vector 3.x

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H CVSS v3.1 Severity and Metrics:

Base Score: 9.10 CRITICAL
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): High
Integrity (I): None
Availability (A): High