What’s Vulnerable › Vulnerabilities

CVE-2024-42054

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-07-28 · updated 2026-06-17
• Weakness: CWE-434

Description

Cervantes through 0.5-alpha accepts insecure file uploads.

Affected products

• CervantesSec cervantes: 0.3-alpha, 0.4-alpha, 0.5-alpha

References

• https://github.com/CervantesSec/cervantes/commit/78631a034d0fb3323a53fb7428b2022b29a0d2cd
• https://www.getastra.com/blog/vulnerability/xss-insecure-file-cervantes/
• https://www.jinsonvarghese.com/stored-xss-file-upload-vulnerabilities-found-in-cervantes/
• https://github.com/CervantesSec/cervantes/commit/78631a034d0fb3323a53fb7428b2022b29a0d2cd
• https://www.getastra.com/blog/vulnerability/xss-insecure-file-cervantes/
• https://www.jinsonvarghese.com/stored-xss-file-upload-vulnerabilities-found-in-cervantes/

Get alerted when CVE-2024-42054 or the next vulnerability affects your stack