CVE-2024-55417

DevDojo Voyager through version 1.8.0 is vulnerable to bypassing the file type verification when an authenticated user uploads a file via /admin/media/upload. An authenticated user can upload a web shell causing arbitrary code execution on the server.

CVSS v3.1 CNA

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS

14.12% chance of exploitation in the next 30 days, 97th percentile

Nuclei

high

Published

2025-01-30

Updated

2026-02-26

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-55417.yaml

Security advisories

• https://www.sonarsource.com/blog/the-tainted-voyage-uncovering-voyagers-vulnerabilities
• advisories/GHSA-35p2-5vrh-m3p6
• thedevdojo/voyager/blob/1.6/src/Http/Controllers/VoyagerMediaController.php#L238

References

• CVE Record
• NVD entry