Read the docs
TI-2024-05970 Aliases CVE-2024-6433GHSA-vrf6-3396-g684

Local File Inclusion in stitionai/devika

Priority HIGH 66CWE-23Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-23 and the CVSS impact.

Summary

The application zips all the files in the folder specified by the user, which allows an attacker to read arbitrary files on the system by providing a crafted path. This vulnerability can be exploited by sending a request to the application with a malicious snapshot_path parameter.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00556 46th percentileScored 2026-11-07
Fix Fixed stitionai/devika (stitionai): -

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
stitionaistitionai/devikabefore --Patch availableCNA
  • stitionai/devika Vendorstitionai Affected before - Fixed in - Patch available CNA

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:stitionai:devika:*:*:*:*:*:*:*:*——stitionai
  • cpe:2.3:a:stitionai:devika:*:*:*:*:*:*:*:* Versions — — ·stitionai

Remediation

  • Fix · CNA stitionai/devika (stitionai) Fixed in -

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-6433
  2. 2026-10-03 Alias added: GHSA-vrf6-3396-g684

References

Other 1

  • TI-2024-26916 The snapshot_path parameter in the /api/get-browser-snapshot endpoint in stitionai devika… CVSS 3.1CRITICAL 9.1
  • TI-2024-05493 Path Traversal in stitionai/devika CVSS 3.0CRITICAL 9.1
  • TI-2024-05156 Directory Traversal in stitionai/devika CVSS 3.0HIGH 7.5
  • TI-2024-05155 Directory Traversal in stitionai/devika CVSS 3.0HIGH 7.5
  • TI-2024-04953 Local File Read in stitionai/devika CVSS 3.0HIGH 7.5
  • TI-2024-05397 Unprotected WebSocket in stitionai/devika CVSS 3.1HIGH 8.8
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences