{"id":"CVE-2024-52293","published":"2024-11-13T16:04:52Z","modified":"2024-11-13T18:56:00Z","title":"Craft has a Potential Remote Code Execution via missing path normalization & Twig SSTI","vendor":"Craft CMS","product":"cms","tier":"tail","description":{"text":"Craft is a content management system (CMS). Prior to 4.12.2 and 5.4.3, Craft is missing normalizePath in the function FileHelper::absolutePath could lead to Remote Code Execution on the server via twig SSTI. This is a sequel to CVE-2023-40035. This vulnerability is fixed in 4.12.2 and 5.4.3.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01358,"percentile":0.71648,"provenance":"source"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"https://github.com/craftcms/cms/security/advisories/GHSA-f3cw-hg6r-chfv","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/craftcms/cms/commit/123e48a696de1e2f63ab519d4730eb3b87beaa58","tags":["x_refsource_MISC"]}],"priority":{"score":19.4,"factors":[{"name":"EPSS percentile","points":14.33},{"name":"CVSS severity","points":5.04}]},"vendorSlug":"craft-cms","affectedVersions":[{"vendor":"craftcms","product":"cms","versions":[">= 4.0.0-RC1, < 4.12.2",">= 5.0.0-RC1, < 5.4.3"]}],"affected":[{"ecosystem":"Packagist","package":"craftcms/cms","vulnerableRanges":[">=4.0.0-RC1, <4.12.2",">=5.0.0-RC1, <5.4.3"],"patched":["4.12.2","5.4.3"],"from":["GHSA-f3cw-hg6r-chfv"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-3241","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-craft-cms-cms-cve-2023-40035","parents":[{"from":"CVE-2023-40035","to":"CVE-2024-52293","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["src/helpers/FileHelper.php"],"commits":["https://github.com/craftcms/cms/commit/0bd33861abdc60c93209cff03eeee54504d3d3b5","https://github.com/craftcms/cms/commit/123e48a696de1e2f63ab519d4730eb3b87beaa58"],"basis":"rarely changed file"}]}],"children":[{"from":"CVE-2024-52293","to":"CVE-2025-46731","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-f3cw-hg6r-chfv","via":"related"},{"kind":"osv-related","provenance":"source","id":"GHSA-7c58-g782-9j38","via":"reference","url":"https://github.com/craftcms/cms/security/advisories/GHSA-f3cw-hg6r-chfv"}]},{"from":"CVE-2024-52293","to":"CVE-2025-57811","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-crcq-738g-pqvc","via":"reference","url":"https://github.com/craftcms/cms/security/advisories/GHSA-f3cw-hg6r-chfv"}]}],"packageHistory":[{"cve":"CVE-2023-36260","published":"2024-01-30","fixed":"4.6.2","kev":false,"link":{"from":"CVE-2023-36260","to":"CVE-2024-52293","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:craftcms/cms","fromFixed":"4.6.2","toFixed":"4.12.2","daysApart":288}]}},{"cve":"CVE-2024-45406","published":"2024-09-09","fixed":"5.1.2","kev":false},{"cve":"CVE-2024-41800","published":"2024-07-25","fixed":"5.2.3","kev":false,"link":{"from":"CVE-2024-41800","to":"CVE-2024-52293","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:craftcms/cms","fromFixed":"5.2.3","toFixed":"5.4.3","daysApart":111}]}},{"cve":"CVE-2024-52293","published":"2024-11-13","fixed":"5.4.3","kev":false},{"cve":"CVE-2024-52291","published":"2024-11-13","fixed":"5.4.6","kev":false,"link":{"from":"CVE-2024-52293","to":"CVE-2024-52291","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:craftcms/cms","fromFixed":"4.12.2","toFixed":"4.12.5","daysApart":0},{"kind":"version-step","provenance":"source","package":"Packagist:craftcms/cms","fromFixed":"5.4.3","toFixed":"5.4.6","daysApart":0}]}},{"cve":"CVE-2024-52292","published":"2024-11-13","fixed":"5.4.9","kev":false},{"cve":"CVE-2024-56145","published":"2024-12-18","fixed":"5.5.2","kev":true}],"package":"Packagist:craftcms/cms"}}