CVE-2024-3311

A vulnerability was found in Dreamer CMS up to 4.1.3.0. It has been declared as critical. Affected by this vulnerability is the function ZipUtils.unZipFiles of the file controller/admin/ThemesController.java. The manipulation leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.1.3.1 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-259369 was assigned to this vulnerability.

• CWE-22
• CWE-22

• https://gitee.com/iteachyou/dreamer_cms/releases/tag/Latest_Stable_Release_4.1.3.1Release Notes
• https://gitee.com/y1336247431/poc-public/issues/I9BA5RExploit, Third Party Advisory
• https://vuldb.com/?ctiid.259369Permissions Required, VDB Entry
• https://vuldb.com/?id.259369Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.303874Third Party Advisory, VDB Entry
• https://gitee.com/iteachyou/dreamer_cms/releases/tag/Latest_Stable_Release_4.1.3.1Release Notes
• https://gitee.com/y1336247431/poc-public/issues/I9BA5RExploit, Third Party Advisory
• https://vuldb.com/?ctiid.259369Permissions Required, VDB Entry
• https://vuldb.com/?id.259369Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.303874Third Party Advisory, VDB Entry

Published

Apr 4, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-3308The HT Mega – Absolute Addons For Elementor plugin for WordP…5.4
• CVE-2024-3309The Qi Addons For Elementor plugin for WordPress is vulnerab…5.4
• CVE-2024-33101A stored cross-site scripting (XSS) vulnerability in the com…6.1
• CVE-2024-33102A stored cross-site scripting (XSS) vulnerability in the com…5.4
• CVE-2024-33103An arbitrary file upload vulnerability in the Media Manager …6.1
• CVE-2024-33109Directory Traversal in the web interface of the Tiptel IP 28…9.8
• CVE-2024-33110D-Link DIR-845L router v1.01KRb03 and before is vulnerable t…9.1
• CVE-2024-33111D-Link DIR-845L router <=v1.01KRb03 is vulnerable to Cross S…5.4
• CVE-2024-33112D-Link DIR-845L router v1.01KRb03 and before is vulnerable t…7.5
• CVE-2024-33113D-LINK DIR-845L <=v1.01KRb03 is vulnerable to Information di…5.3
• CVE-2024-33117crmeb_java v1.3.4 was discovered to contain a Server-Side Re…5.3
• CVE-2024-33118LuckyFrameWeb v3.5.2 was discovered to contain an arbitrary …7.5