CVE-2024-54819

CVE-2024-54819 is a Server-Side Request Forgery (SSRF) vulnerability affecting I, Librarian versions before and including 5.11.1. The issue arises from improper input validation in the file classes/security/validation.php. It carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and maps to CWE-918: Server-Side Request Forgery. The vulnerability was published on 2025-01-07.

Unauthenticated remote attackers can exploit this vulnerability over the network with low attack complexity and no user interaction required. Successful exploitation enables high-impact compromise of confidentiality and integrity, while availability remains unaffected.

Patches and mitigation details are available via the fixing commit at https://github.com/mkucej/i-librarian-free/commit/ed36f6f258392fa2ec72f9820661ded75d91accc. Additional research and advisory information is provided at https://www.partywave.site/show/research/cve-2024-54819-i-librarian-server-side-request-forgery and https://github.com/partywavesec/CVE-2024-55557.