What’s Vulnerable › Vulnerabilities

CVE-2024-25155: Reflected Cross-Site Scripting (XSS) in FileCatalyst Direct 3.8.8 and earlier

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-03-13 · updated 2026-06-17
• Weakness: CWE-79

Description

In FileCatalyst Direct 3.8.8 and earlier through 3.8.6, the web server does not properly sanitize illegal characters in a URL which is then displayed on a subsequent error page. A malicious actor could craft a URL which would then execute arbitrary code within an HTML script tag.

Affected products

• Fortra FileCatalyst: from 3.0.0 before 3.8.9 — fixed in 3.8.9

How to fix

Upgrade to a fixed version: Fortra FileCatalyst 3.8.9. Check the vendor advisory for mitigations.

References

• https://filecatalyst.software/public/filecatalyst/Direct/3.8.9.90/whatsnew_direct.html
• https://www.fortra.com/security/advisory/fi-2024-003
• https://filecatalyst.software/public/filecatalyst/Direct/3.8.9.90/whatsnew_direct.html
• https://www.fortra.com/security/advisory/fi-2024-003

Get alerted when CVE-2024-25155 or the next vulnerability affects your stack