CVE-2024-55602: Path Traversal in PwnDoc

An attacker exploiting this vulnerability could gain unauthorized access to sensitive files stored on the system where PwnDoc is running. This could include configuration files, source code, or other confidential data. The ability to read arbitrary files significantly expands the potential attack surface, allowing an attacker to gather information for further exploitation or compromise the system's integrity. While authentication is required, the ease of exploitation once authenticated poses a significant risk, especially in environments where user privileges are not strictly controlled.

1. Reserved2024-12-09
2. Published2024-12-10
3. EPSS updated2026-04-02

The primary mitigation for CVE-2024-55602 is to upgrade PwnDoc to version 1d4219c596f4f518798492e48386a20c6e9a2fe6, which contains the fix. If upgrading is not immediately possible, restrict access to template update and download functionalities to only trusted users. Implement strict input validation on file extension properties to prevent the injection of path traversal sequences. Consider using a Web Application Firewall (WAF) with rules to detect and block attempts to access files outside of the intended directory. After upgrade, confirm the fix by attempting to upload a template with a path traversal sequence in the file extension and verifying that access is denied.