CVE-2024-42007

SPX (aka php-spx) through 0.4.15 allows SPX_UI_URI Directory Traversal to read arbitrary files.

CVSS v3.1

5.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

EPSS

0.64% chance of exploitation in the next 30 days, 48th percentile

Published

2024-07-26

Updated

2024-08-19

Proof-of-concept exploits (2)

• https://www.vicarius.io/vsociety/posts/journey-to-discovery-and-exploitation-of-path-trav…
• BubblyCola/CVE_2024_420074★ · 2025-04-06

References

• CVE Record
• NVD entry

Related

• CVE-2024-42005
• CVE-2024-42008
• CVE-2024-41992
• CVE-2024-42009
• CVE-2024-41958
• CVE-2024-4201