TI-2024-20814 Aliases CVE-2024-31450 GHSA-9355-27m8-h74v

Owncast vulnerable to arbitrary file deletion in emoji.go (GHSL-2023-277)

MEDIUM 62CWE-22Published 2024-04-19 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. The Owncast application exposes an administrator API at the URL /api/admin. The emoji/delete endpoint of said API allows administrators to delete custom emojis, which are saved on disk. The parameter name is taken from the JSON request and directly appended to the filepath that points to the emoji to delete. By using path traversal sequences (../), attackers with administrative privileges can exploit this endpoint to delete arbitrary files on the system, outside of the emoji directory. This vulnerability is fixed in 0.1.3.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00969 62nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed owncast (owncast): 0.1.3github.com/owncast/owncast (Go): 0.1.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
owncast	owncast	before 0.1.3	0.1.3	Patch available	CNA
—	github.com/owncast/owncast (Go)	before 0.1.3	0.1.3	Patch available	GHSA-9355-27m8-h74v

owncast Vendorowncast Affected before 0.1.3 Fixed in 0.1.3 Patch available CNA
github.com/owncast/owncast (Go) Vendor— Affected before 0.1.3 Fixed in 0.1.3 Patch available GHSA-9355-27m8-h74v

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:owncast_project:owncast::::::::	before 0.1.3	Vulnerable	owncast

cpe:2.3:a:owncast_project:owncast:*:*:*:*:*:*:*:* Versions before 0.1.3 Vulnerable ·owncast

Remediation

Fix · CNA owncast (owncast) Fixed in 0.1.3
Fix · GHSA-9355-27m8-h74v github.com/owncast/owncast (Go) Fixed in 0.1.3 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-31450
2026-10-03 Alias added: GHSA-9355-27m8-h74v

References

Exploit 1

https://securitylab.github.com/advisories/GHSL-2023-277_Owncast/

Patch 1

https://github.com/owncast/owncast/commit/1b14800c7d7f54be14ed4d130bfe7f480645076e

Advisory 2

Other 3

TI-2023-25026 An issue in OwnCast v.0.1.1 allows a remote attacker to execute arbitrary code and obtain… CVSS 3.1CRITICAL 9.8
TI-2022-03445 SQL Injection in owncast/owncast CVSS 3.1CRITICAL 9.8
TI-2023-02986 Server-Side Request Forgery (SSRF) in owncast/owncast CVSS 3.1MEDIUM 6.5
TI-2024-19208 Owncast cross origin request CVSS 3.1CRITICAL 9.1
TI-2021-16569 Unsafe inline XSS Owncast CVSS 3.1HIGH 8.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences