Most recent entries from all https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 20:56:25 +0000 CVE-2024-52293 — Craft has a Potential Remote Code Execution via missing path normalization & Twig SSTI https://vulnerability.circl.lu/vuln/cve-2024-52293 <p><strong>Affected:</strong> craftcms cms, craftcms craft_cms</p> <p>Craft is a content management system (CMS). Prior to 4.12.2 and 5.4.3, Craft is missing normalizePath in the function FileHelper::absolutePath could lead to Remote Code Execution on the server via twig SSTI. This is a sequel to CVE-2023-40035. This vulnerability is fixed in 4.12.2 and 5.4.3.</p> <p><strong>Affected:</strong> craftcms cms, craftcms craft_cms</p> <p>Craft is a content management system (CMS). Prior to 4.12.2 and 5.4.3, Craft is missing normalizePath in the function FileHelper::absolutePath could lead to Remote Code Execution on the server via twig SSTI. This is a sequel to CVE-2023-40035. This vulnerability is fixed in 4.12.2 and 5.4.3.</p> https://vulnerability.circl.lu/vuln/cve-2024-52293