CVE-2024-55417
Medium · 4.3DevDojo Voyager Arbitrary File Write
CVSS
4.3
EPSS
14.1%
Published
Jan 30, 2025
CISA due date
—
The record
DevDojo Voyager through version 1.8.0 is vulnerable to bypassing the file type verification when an authenticated user uploads a file via /admin/media/upload. An authenticated user can upload a web shell causing arbitrary code execution on the server.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | tcg/voyager | 0 | No fix |
Related vulnerabilities
- CVE-2024-55415 DevDojo Voyager vulnerable to path traversal Also affects tcg/voyager
- CVE-2024-55416 DevDojo Voyager vulnerable to reflected Cross-site Scripting Also affects tcg/voyager
- CVE-2026-8778 The MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields. CWE-434
- CVE-2026-12215 The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authentication… CWE-434
- CVE-2026-18351 The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to… CWE-434
- CVE-2026-71805 An arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0. CWE-434
- CVE-2026-26212 Rara One Click Demo Import plugin for WordPress before 1.3.5 contains an arbitrary file… CWE-434
- CVE-2026-54611 InstantCMS is a free and open source content management system. CWE-434