CVE-2024-55602

PwnDoc is a penetration test report generator. Prior to commit 1d4219c596f4f518798492e48386a20c6e9a2fe6, an authenticated user who is able to update and download templates can inject path traversal (`../`) sequences into the file extension property to read arbitrary files on the system. Commit 1d4219c596f4f518798492e48386a20c6e9a2fe6 contains a patch for the issue.

• CWE-22

• https://gist.github.com/JorianWoltjer/8a42e25c6dfa7604020d2a226e193407Product
• https://github.com/pwndoc/pwndoc/blob/2e7f5747d5688b1368e549c786ce7266fe5ab2b5/backend/src/routes/template.js#L103Product
• https://github.com/pwndoc/pwndoc/blob/2e7f5747d5688b1368e549c786ce7266fe5ab2b5/backend/src/routes/template.js#L43-L47Product
• https://github.com/pwndoc/pwndoc/commit/1d4219c596f4f518798492e48386a20c6e9a2fe6Patch
• https://github.com/pwndoc/pwndoc/security/advisories/GHSA-2mqc-gg7h-76p6Exploit, Vendor Advisory
• https://gist.github.com/JorianWoltjer/8a42e25c6dfa7604020d2a226e193407Product
• https://github.com/pwndoc/pwndoc/security/advisories/GHSA-2mqc-gg7h-76p6Exploit, Vendor Advisory

Published

Dec 10, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-55594An improper handling of syntactically invalid structure in F…9.8
• CVE-2024-55595Rejected reason: Not used
• CVE-2024-55597A improper limitation of a pathname to a restricted director…7.2
• CVE-2024-55599An Improperly Implemented Security Check for Standard vulner…5.3
• CVE-2024-5560CWE-125: Out-of-bounds Read vulnerability exists that could …7.5
• CVE-2024-55601Hugo is a static site generator. Starting in version 0.123.0…5.3
• CVE-2024-55603Kanboard is project management software that focuses on the …6.5
• CVE-2024-55604Appsmith is a platform to build admin panels, internal tools…4.3
• CVE-2024-55605Suricata is a network Intrusion Detection System, Intrusion …7.5
• CVE-2024-5561The Popup Maker WordPress plugin before 1.19.1 does not san…4.8
• CVE-2024-55626Suricata is a network Intrusion Detection System, Intrusion …5.5
• CVE-2024-55627Suricata is a network Intrusion Detection System, Intrusion …7.5