CVE-2024-5821: Local File Inclusion (LFI) in stitionai/devika

Severity: medium (CVSS 6.2 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-07-03 · updated 2026-06-17
Weakness: CWE-22

Description

The vulnerability allows an attacker to access sensitive files on the server by confusing the agent with incorrect file names. When a user requests the content of a file with a misspelled name, the agent attempts to correct the command and inadvertently reveals the content of the intended file, such as /etc/passwd. This can lead to unauthorized access to sensitive information and potential server compromise.

Affected products

stitionai/devika: all versions

References

https://huntr.com/bounties/6b729046-b9e1-4fa2-a0c5-603745a6db6b
https://huntr.com/bounties/6b729046-b9e1-4fa2-a0c5-603745a6db6b

Get alerted when CVE-2024-5821 or the next vulnerability affects your stack