SB2024111363 - Input validation error in Craft CMS

Description

This security bulletin contains information about 1 security vulnerability.

1) Input validation error (CVE-ID: CVE-2024-52291)

The vulnerability allows a remote user to overwrite files, access sensitive files, and potentially execute arbitrary code.

The vulnerability exists due to improper input validation in FileHelper::normalizePath() when processing file system base path values containing a double file:// scheme. A remote privileged user can configure a crafted file system path and upload files to overwrite files, access sensitive files, and potentially execute arbitrary code.

User interaction is required, and exploitation requires an authenticated administrator account with allowAdminChanges enabled.

Remediation

Install update from vendor's website.

References

• https://github.com/craftcms/cms/security/advisories/GHSA-jrh5-vhr9-qh7q
• https://github.com/advisories/GHSA-jrh5-vhr9-qh7q