CVE-2024-36267

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-30 · updated 2026-06-17
Weakness: CWE-22

Description

Path traversal vulnerability exists in Redmine DMSF Plugin versions prior to 3.1.4. If this vulnerability is exploited, a logged-in user may obtain or delete arbitrary files on the server (within the privilege of the Redmine process).

Affected products

Kontron Redmine DMSF Plugin: before 3.1.4 — fixed in 3.1.4

How to fix

Upgrade to a fixed version: Kontron Redmine DMSF Plugin 3.1.4. Check the vendor advisory for mitigations.

References

https://github.com/danmunn/redmine_dmsf
https://jvn.jp/en/jp/JVN22182715/
https://github.com/danmunn/redmine_dmsf
https://jvn.jp/en/jp/JVN22182715/

Get alerted when CVE-2024-36267 or the next vulnerability affects your stack