CVE-2024-23822

Thruk is a multibackend monitoring webinterface. Prior to 3.12, the Thruk web monitoring application presents a vulnerability in a file upload form that allows a threat actor to arbitrarily upload files to the server to any path they desire and have permissions for. This vulnerability is known as Path Traversal or Directory Traversal. Version 3.12 fixes the issue.

• CWE-22

• https://github.com/sni/Thruk/commit/1aa9597cdf2722a69651124f68cbb449be12cc39Patch
• https://github.com/sni/Thruk/security/advisories/GHSA-4mrh-mx7x-rqjxExploit, Patch, Vendor Advisory
• https://github.com/sni/Thruk/commit/1aa9597cdf2722a69651124f68cbb449be12cc39Patch
• https://github.com/sni/Thruk/security/advisories/GHSA-4mrh-mx7x-rqjxExploit, Patch, Vendor Advisory

Published

Jan 29, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-23817Dolibarr is an enterprise resource planning (ERP) and custom…6.1
• CVE-2024-23818GeoServer is an open source software server written in Java …4.8
• CVE-2024-23819GeoServer is an open source software server written in Java …4.8
• CVE-2024-2382The Authorize.net Payment Gateway For WooCommerce plugin for…5.3
• CVE-2024-23820OpenFGA, an authorization/permission engine, is vulnerable t…6.5
• CVE-2024-23821GeoServer is an open source software server written in Java …4.8
• CVE-2024-23823vantage6 is an open source framework built to enable, manage…6.5
• CVE-2024-23824mailcow is a dockerized email package, with multiple contain…2.7
• CVE-2024-23825TablePress is a table plugin for Wordpress. For importing ta…4.9
• CVE-2024-23826spbu_se_site is the website of the Department of System Prog…5.7
• CVE-2024-23827Nginx-UI is a web interface to manage Nginx configurations. …9.8
• CVE-2024-23828Nginx-UI is a web interface to manage Nginx configurations. …8.8