CVE-2024-46898: Path Traversal in SHIRASAGI

The path traversal vulnerability in SHIRASAGI allows an attacker to bypass intended access controls and read files outside of the intended web root. By crafting malicious HTTP requests with carefully constructed paths, an attacker can potentially access sensitive configuration files, source code, or other data stored on the server. The impact can range from information disclosure to potential compromise of the entire system, depending on the files accessed and the privileges of the web server process. This vulnerability is similar in nature to other path traversal flaws that have been exploited to gain unauthorized access to systems.

1. Reserved2024-10-04
2. Published2024-10-15
3. Modified2024-10-23
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-46898 is to upgrade SHIRASAGI to version 1.19.1 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting access to the SHIRASAGI service through a Web Application Firewall (WAF) or proxy server. Configure the WAF to block requests containing suspicious path traversal patterns (e.g., “../”). Carefully review and restrict file permissions on the server to minimize the potential impact of a successful exploit. After upgrading, confirm the fix by attempting to access files outside the intended web root via HTTP requests; access should be denied.