What’s Vulnerable › Vulnerabilities

CVE-2024-2045: Session 1.17.5 - LFR via chat attachment

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-03-01 · updated 2026-06-17
• Weakness: CWE-22

Description

Session version 1.17.5 allows obtaining internal application files and public files from the user's device without the user's consent. This is possible because the application is vulnerable to Local File Read via chat attachments.

Affected products

• Session: 1.17.5

References

• https://fluidattacks.com/advisories/newman/
• https://github.com/oxen-io/session-android/
• https://fluidattacks.com/advisories/newman/
• https://github.com/oxen-io/session-android/

Get alerted when CVE-2024-2045 or the next vulnerability affects your stack