Path Traversal vulnerability via File Uploads in Genie
Priority HIGH 82CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
A path traversal issue potentially leading to remote code execution in Genie for all versions prior to 4.3.18
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.24629 97th percentileScored 2026-11-07
Fix Fixed com.netflix.genie:genie-web (Maven): 4.3.18
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | com.netflix.genie:genie-web (Maven) | before 4.3.18 | 4.3.18 | Patch available | GHSA-wpcv-5jgp-69f3 |
- com.netflix.genie:genie-web (Maven) Vendor— Affected before 4.3.18 Fixed in 4.3.18 Patch available GHSA-wpcv-5jgp-69f3
Remediation
- Fix · GHSA-wpcv-5jgp-69f3 com.netflix.genie:genie-web (Maven) Fixed in 4.3.18 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-4701
- 2026-10-03 Alias added: GHSA-wpcv-5jgp-69f3
References
Other 6
- https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2024-001.md
- https://github.com/Netflix/genie/security/advisories/GHSA-wpcv-5jgp-69f3
- https://github.com/Netflix/genie/pull/1217
- https://github.com/Netflix/genie/commit/6bad017d8078c94e80d6c6fe8abd693910bf55cf
- https://github.com/Netflix/genie
- https://github.com/Netflix/genie/releases/tag/v4.3.18
More Netflix vulnerabilities
- TI-2023-21044 Dispatch writes JWT tokens in error message CVSS 3.1CRITICAL 9.1
- TI-2026-39854 Improper authorization in Netflix lemur CVSS 3.1CRITICAL 9.9
- TI-2026-32272 Lemur: LDAP Filter Injection enables post-authentication privilege escalation CVSS 3.1HIGH 8.1
- TI-2026-49966 Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates CVSS 3.1HIGH 8.1
- TI-2026-49965 Missing authorization in Netflix lemur CVSS 3.1HIGH 7.7
- TI-2026-49964 Server-side request forgery in Netflix lemur CVSS 3.1HIGH 7.7
Sources
- CVE-2024-4701 · CVE Program
- CVE-2024-4701 · NVD
- FIRST EPSS
- GHSA-wpcv-5jgp-69f3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences