CVE-2024-5548

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-5548
A directory traversal vulnerability exists in the stitionai/devika repository, specifically within the /api/download-project endpoint. Attackers can exploit this vulnerability by manipulating the 'project_name' parameter in a GET request to download arbitrary files from the system. This issue affects the latest version of the repository. The vulnerability arises due to insufficient input validation in the 'download_project' function, allowing attackers to traverse the directory structure and access files outside the intended directory. This could lead to unauthorized access to sensitive files on the server.
CVSS

No CVSS.

References
Link Resource
https://github.com/stitionai/devika/commit/6acce21fb08c3d1123ef05df6a33912bf0ee77c2 Patch
https://github.com/stitionai/devika/commit/6acce21fb08c3d1123ef05df6a33912bf0ee77c2 Patch
https://huntr.com/bounties/ad7dd135-8839-4042-87c0-105af61d262c Exploit Third Party Advisory
https://huntr.com/bounties/ad7dd135-8839-4042-87c0-105af61d262c Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:stitionai:devika:1.0:*:*:*:*:*:*:*
History

15 Jul 2025, 15:37

Type Values Removed Values Added
CWE CWE-22
First Time Stitionai devika
Stitionai
CPE cpe:2.3:a:stitionai:devika:1.0:*:*:*:*:*:*:*
References () https://github.com/stitionai/devika/commit/6acce21fb08c3d1123ef05df6a33912bf0ee77c2 - () https://github.com/stitionai/devika/commit/6acce21fb08c3d1123ef05df6a33912bf0ee77c2 - Patch
References () https://huntr.com/bounties/ad7dd135-8839-4042-87c0-105af61d262c - () https://huntr.com/bounties/ad7dd135-8839-4042-87c0-105af61d262c - Exploit, Third Party Advisory

12 Jul 2024, 08:15

Type Values Removed Values Added
Summary Path Traversal in GitHub repository stitionai/devika prior to -. A directory traversal vulnerability exists in the stitionai/devika repository, specifically within the /api/download-project endpoint. Attackers can exploit this vulnerability by manipulating the 'project_name' parameter in a GET request to download arbitrary files from the system. This issue affects the latest version of the repository. The vulnerability arises due to insufficient input validation in the 'download_project' function, allowing attackers to traverse the directory structure and access files outside the intended directory. This could lead to unauthorized access to sensitive files on the server.

27 Jun 2024, 19:25

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-27 18:15

Updated : 2025-07-15 15:37

NVD link : CVE-2024-5548

Mitre link : CVE-2024-5548

JSON object : View

Products Affected

stitionai

  • devika
CWE

No CWE.