CVE-2024-5547: Directory Traversal in Devika

An attacker can exploit this vulnerability to bypass intended directory restrictions and download arbitrary PDF files. This includes potentially accessing sensitive documents, financial records, or proprietary information stored in PDF format. Successful exploitation could lead to data breaches and compromise the confidentiality of the system. The blast radius extends to any files accessible by the web server user, potentially exposing a wide range of data. While no specific precedent is immediately apparent, the impact is comparable to other directory traversal vulnerabilities where attackers gain unauthorized access to files.

1. Reserved2024-05-30
2. Published2024-06-27
3. Modified2024-08-01
4. EPSS updated2026-04-02

Due to the absence of a patch, mitigation focuses on immediate workarounds. Implement strict input validation on the project_name parameter, ensuring it only accepts expected characters and formats. Configure a web application firewall (WAF) to block requests containing suspicious characters or path traversal sequences (e.g., ../). Restrict file system permissions to prevent the web server user from accessing sensitive directories. Consider implementing a proxy server with content filtering capabilities to further restrict access. Regularly monitor access logs for suspicious activity related to the /api/download-project-pdf endpoint. After implementing these mitigations, verify that the endpoint is no longer accessible without proper authentication and authorization.