CVE-2024-22723: Webtrees Path Traversal vulnerability

February 28, 2024 (updated January 21, 2025)

Webtrees 2.1.18 is vulnerable to Directory Traversal. By manipulating the “media_folder” parameter in the URL, an attacker (in this case, an administrator) can navigate beyond the intended directory (the ‘media/’ directory) to access sensitive files in other parts of the application’s file system.

References

cupc4k3.medium.com/cve-2024-22723-webtrees-vulnerability-uncovering-sensitive-data-through-path-traversal-7442e7a38b68
github.com/advisories/GHSA-6w5q-79rf-7c49
github.com/fisharebest/webtrees
nvd.nist.gov/vuln/detail/CVE-2024-22723

Code Behaviors & Features

Detect and mitigate CVE-2024-22723 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →