CVE-2024-55417: DevDojo Voyager Arbitrary File Write

January 30, 2025 (updated February 6, 2025)

DevDojo Voyager through version 1.8.0 is vulnerable to bypassing the file type verification when an authenticated user uploads a file via /admin/media/upload. An authenticated user can upload a web shell causing arbitrary code execution on the server.

References

github.com/advisories/GHSA-35p2-5vrh-m3p6
github.com/thedevdojo/voyager
github.com/thedevdojo/voyager/blob/1.6/src/Http/Controllers/VoyagerMediaController.php
nvd.nist.gov/vuln/detail/CVE-2024-55417
www.sonarsource.com/blog/the-tainted-voyage-uncovering-voyagers-vulnerabilities

Code Behaviors & Features

Detect and mitigate CVE-2024-55417 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →