CVE-2024-50344

I, Librarian is an open-source version of a PDF managing SaaS. Supplemental Files are allowed to be viewed in the browser, only if they have a white-listed MIME type. Unfortunately, this logic is broken, thus allowing unsafe files containing Javascript to be executed with the application context. An attacker can exploit this vulnerability by uploading a supplementary file that contains a malicious code or script. This code will then be executed when the file is loaded in the browser. The vulnerability was fixed in version 5.11.2.

• CWE-80

• https://github.com/mkucej/i-librarian-free/commit/a67d7949ffb02fd912ebdcf552df006b44066d78
• https://github.com/mkucej/i-librarian-free/security/advisories/GHSA-c2rm-w62w-5xmj

Published

Oct 30, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-50339GLPI is a free asset and IT management software package. Sta…5.3
• CVE-2024-5034The SULly WordPress plugin before 4.3.1 does not have CSRF c…8.8
• CVE-2024-50340symfony/runtime is a module for the Symphony PHP framework w…7.3
• CVE-2024-50341symfony/security-bundle is a module for the Symphony PHP fra…3.1
• CVE-2024-50342symfony/http-client is a module for the Symphony PHP framewo…4.3
• CVE-2024-50343symfony/validator is a module for the Symphony PHP framework…3.1
• CVE-2024-50345symfony/http-foundation is a module for the Symphony PHP fra…6.1
• CVE-2024-50346WebFeed is a lightweight web feed reader extension for Firef…5.1
• CVE-2024-50347Laravel Reverb provides a real-time WebSocket communication …6.3
• CVE-2024-50348InstantCMS is a free and open source content management syst…5.4
• CVE-2024-50349Git is a fast, scalable, distributed revision control system…4.7
• CVE-2024-5035The affected device expose a network service called "rftest"…8.8