CVE-2024-22049

httparty before 0.21.0 is vulnerable to an assumed-immutable web parameter vulnerability. A remote and unauthenticated attacker can provide a crafted filename parameter during multipart/form-data uploads which could result in attacker controlled filenames being written.

• CWE-472

• https://github.com/advisories/GHSA-5pq7-52mg-hr42Exploit, Third Party Advisory
• https://github.com/jnunemaker/httparty/blob/4416141d37fd71bdba4f37589ec265f55aa446ce/lib/httparty/request/body.rb#L43Exploit
• https://github.com/jnunemaker/httparty/commit/cdb45a678c43e44570b4e73f84b1abeb5ec22b8ePatch
• https://github.com/jnunemaker/httparty/security/advisories/GHSA-5pq7-52mg-hr42Exploit, Patch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2024/01/msg00011.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4LDGAVPR4KB72V4GGQCWODEAI72QZI3V/Mailing List
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IOWECZPJY6JZIA5FSBJR77KCRDXWDZDA/Mailing List
• https://vulncheck.com/advisories/vc-advisory-GHSA-5pq7-52mg-hr42Patch, Third Party Advisory
• https://github.com/advisories/GHSA-5pq7-52mg-hr42Exploit, Third Party Advisory
• https://github.com/jnunemaker/httparty/blob/4416141d37fd71bdba4f37589ec265f55aa446ce/lib/httparty/request/body.rb#L43Exploit
• https://github.com/jnunemaker/httparty/commit/cdb45a678c43e44570b4e73f84b1abeb5ec22b8ePatch
• https://github.com/jnunemaker/httparty/security/advisories/GHSA-5pq7-52mg-hr42Exploit, Patch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2024/01/msg00011.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2024/09/msg00043.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4LDGAVPR4KB72V4GGQCWODEAI72QZI3V/Mailing List
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IOWECZPJY6JZIA5FSBJR77KCRDXWDZDA/Mailing List
• https://vulncheck.com/advisories/vc-advisory-GHSA-5pq7-52mg-hr42Patch, Third Party Advisory

Published

Jan 4, 2024

Last Modified

Jul 14, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-22042A vulnerability has been identified in Unicam FX (All versio…7.8
• CVE-2024-22043A vulnerability has been identified in Parasolid V35.0 (All …5.5
• CVE-2024-22044A vulnerability has been identified in SENTRON 3KC ATC6 Expa…7.5
• CVE-2024-22045A vulnerability has been identified in SINEMA Remote Connect…6.5
• CVE-2024-22047A race condition exists in Audited 4.0.0 to 5.3.3 that can r…3.1
• CVE-2024-22048govuk_tech_docs versions from 2.0.2 to before 3.3.1 are vuln…6.1
• CVE-2024-22050Path traversal in the static file service in Iodine less tha…7.5
• CVE-2024-22051CommonMarker versions prior to 0.23.4 are at risk of an inte…9.8
• CVE-2024-22052A null pointer dereference vulnerability in IPSec component …7.5
• CVE-2024-22053A heap overflow vulnerability in IPSec component of Ivanti C…8.2
• CVE-2024-22054A malformed discovery packet sent by a malicious actor with …7.5
• CVE-2024-22058A buffer overflow allows a low privilege user on the local m…7.8