CVE-2024-3686

A vulnerability has been found in DedeCMS 5.7.112-UTF8 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file update_guide.php. The manipulation of the argument files leads to path traversal: '../filedir'. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260473 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-24
• CWE-22

• https://github.com/Echosssy/CVE/blob/main/Dedecms%E6%9C%80%E6%96%B0%E7%89%88%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E5%88%A0%E9%99%A4%E7%BB%95%E8%BF%87.pdfExploit
• https://vuldb.com/?ctiid.260473Permissions Required, VDB Entry
• https://vuldb.com/?id.260473Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.309454Third Party Advisory, VDB Entry
• https://github.com/Echosssy/CVE/blob/main/Dedecms%E6%9C%80%E6%96%B0%E7%89%88%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E5%88%A0%E9%99%A4%E7%BB%95%E8%BF%87.pdfExploit
• https://vuldb.com/?ctiid.260473Permissions Required, VDB Entry
• https://vuldb.com/?id.260473Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.309454Third Party Advisory, VDB Entry

Published

Apr 12, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-36844libmodbus v3.1.6 was discovered to contain a use-after-free …7.5
• CVE-2024-36845An invalid pointer in the modbus_receive() function of libmo…4.3
• CVE-2024-3685A vulnerability, which was classified as critical, was found…9.8
• CVE-2024-36856RMQTT Broker 0.4.0 is vulnerable to Denial of Service (DoS) …7.5
• CVE-2024-36857Jan v0.4.12 was discovered to contain an arbitrary file read…7.5
• CVE-2024-36858An arbitrary file upload vulnerability in the /v1/app/writeF…9.8
• CVE-2024-3687A vulnerability was found in bihell Dice 3.1.0 and classifie…3.5
• CVE-2024-36877Micro-Star International Z-series motherboards (Z590, Z490, …8.2
• CVE-2024-3688A vulnerability was found in Xiamen Four-Faith RMP Router Ma…6.3
• CVE-2024-36880In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2024-36881In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-36882In the Linux kernel, the following vulnerability has been re…5.5