CVE-2024-40422 EXPLOIT
9.1
CRITICAL · CVSS 3.1 · EPSS 11.4% (pctl 96)
Patch early
A public exploit exists.
Description
The snapshot_path parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to a path traversal attack. An attacker can manipulate the snapshot_path parameter to traverse directories and access sensitive files on the server. This can potentially lead to unauthorized access to critical system files and compromise the confidentiality and integrity of the system.
Scoring
| CVSS | 9.1 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| EPSS | 11.41% — more likely to be exploited than 96% of all CVEs |
| Weakness | CWE-22 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2024-07-24 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| stitionai | devika |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Devika v1 - Path Traversal via 'snapshot_path' | 2024-08-04 |
References
- https://github.com/alpernae/CVE-2024-40422
- https://github.com/stitionai/devika
- https://github.com/stitionai/devika/pull/619
- https://medium.com/@alpernae/uncovering-path-traversal-in-devika-v1-a-deep-dive-into-cve-2024-40422-f8ce81398b99
- https://github.com/alpernae/CVE-2024-40422
- https://github.com/stitionai/devika
- https://github.com/stitionai/devika/pull/619
→ the Explorer · watch your stack · NVD