Read the docs
TI-2024-07699 Aliases CVE-2024-8304GHSA-55hf-7wcx-6xm5

jpress Template Module edit path traversal

Priority MEDIUM 56CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A vulnerability has been found in jpress up to 5.1.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/template/edit of the component Template Module Handler. The manipulation leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00551 46th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—jpress5.1.0; 5.1.1—No fix listedCNA
  • jpress Vendor— Affected 5.1.0; 5.1.1 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:jpress:jpress:*:*:*:*:*:*:*:*up to 5.1.1VulnerableJpress
  • cpe:2.3:a:jpress:jpress:*:*:*:*:*:*:*:* Versions up to 5.1.1 Vulnerable ·Jpress

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-8304
  2. 2026-10-03 Alias added: GHSA-55hf-7wcx-6xm5

References

Exploit 1

  • TI-2024-34150 Jpress until v5.1.1 has arbitrary file uploads on the windows platform, and the… CVSS 3.1CRITICAL 9.8
  • TI-2024-30983 A Server-Side Request Forgery (SSRF) vulnerability exists in the jpress <= v5.1.1, which… CVSS 3.1HIGH 7.5
  • TI-2024-28729 JPress through 5.1.1 on Windows has an arbitrary file upload vulnerability that could… CVSS 3.1HIGH 8.8
  • TI-2024-11455 Guizhou Xiaoma Technology jpress Attachment Upload upload AttachmentUtils.isUnSafe cross site scripting CVSS 4.0MEDIUM 5.3
  • TI-2024-11107 Guizhou Xiaoma Technology jpress Avatar upload cross site scripting CVSS 4.0MEDIUM 5.3
  • TI-2021-20849 jpress v4.2.0 is vulnerable to command execution via io.jpress.web.admin._AddonController::doUploadAndInstall. CVSS 3.1CRITICAL 9.8
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences