CVE-2024-5926

The vulnerability results from insufficient sanitization of the 'project-name' parameter before its use in file operations. An attacker can provide a path containing directory traversal sequences in this parameter, pointing to any location in the file system. If the root directory is specified as the parameter value, the application attempts to read the entire file system, leading to resource exhaustion and a DoS condition.

An attacker can read arbitrary files from the server file system (e.g., configuration files, credentials), and can also cause application unavailability by triggering a DoS condition.

Apply patches available from the vendor according to references. The vendor should implement proper sanitization and validation of the 'project-name' parameter to prevent directory traversal outside the allowed working directory.

All versions of Stitionai Devika application