TI-2024-05155 Aliases CVE-2024-5547 GHSA-g447-v446-74c4

Directory Traversal in stitionai/devika

HIGH 72CWE-23Published 2024-06-27 · Updated 2024-08-01

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-23 and the CVSS impact.

Summary

A directory traversal vulnerability exists in the /api/download-project-pdf endpoint of the stitionai/devika repository, affecting the latest version. The vulnerability arises due to insufficient sanitization of the 'project_name' parameter in the download_project_pdf function. Attackers can exploit this flaw by manipulating the 'project_name' parameter in a GET request to traverse the directory structure and download arbitrary PDF files from the system. This issue allows attackers to access sensitive information that could be stored in PDF format outside the intended directory.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.01 63rd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed stitionai/devika (stitionai): -

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
stitionai	stitionai/devika	before -	-	Patch available	CNA

stitionai/devika Vendorstitionai Affected before - Fixed in - Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:stitionai:devika:1.0:::::::*	1.0	Vulnerable	stitionai

cpe:2.3:a:stitionai:devika:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·stitionai

Remediation

Fix · CNA stitionai/devika (stitionai) Fixed in -

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2024-06-27
stitionai/devika -
3 records Highest priority Priority HIGH 3 HIGH
Other records, highest priority first
- TI-2024-05156 Directory Traversal in stitionai/devikaPriority HIGH 72
- TI-2024-04953 Local File Read in stitionai/devikaPriority HIGH 72
Show all 3 records →

Timeline

2026-10-02 Threatist record created from CVE-2024-5547
2026-10-03 Alias added: GHSA-g447-v446-74c4

References

Exploit 1

https://huntr.com/bounties/7ea0eb5f-7643-4452-bc93-a225e2090283

Patch 1

https://github.com/stitionai/devika/commit/6acce21fb08c3d1123ef05df6a33912bf0ee77c2

TI-2024-26916 The snapshot_path parameter in the /api/get-browser-snapshot endpoint in stitionai devika… CVSS 3.1CRITICAL 9.1
TI-2024-05493 Path Traversal in stitionai/devika CVSS 3.0CRITICAL 9.1
TI-2024-05156 Directory Traversal in stitionai/devika CVSS 3.0HIGH 7.5
TI-2024-04953 Local File Read in stitionai/devika CVSS 3.0HIGH 7.5
TI-2024-05397 Unprotected WebSocket in stitionai/devika CVSS 3.1HIGH 8.8
TI-2024-05306 CSRF Vulnerability in stitionai/devika CVSS 3.0HIGH 8.1

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences