CVE-2024-57451

CVE-2024-57451 is a directory traversal vulnerability affecting ChestnutCMS versions up to and including 1.5.0. The flaw resides in the contentcore.controller.FileController#getFileList method, enabling attackers to bypass path restrictions and access arbitrary directories on the server. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), classified as High severity and mapped to CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The vulnerability was published on 2025-02-03.

Unauthenticated remote attackers can exploit this vulnerability over the network with low attack complexity and no user interaction required. Exploitation allows viewing the contents of any directory on the affected system, resulting in high confidentiality impact by exposing potentially sensitive files, while integrity and availability remain unaffected.

Mitigation details are available in the referenced advisory at https://locrian-lightning-dc7.notion.site/Directory-traversal-1628e5e2b1a280fdb463c2235acc7f75.