CVE-2024-57186: Erxes Path Traversal vulnerability

June 10, 2025 (updated November 10, 2025)

In Erxes <1.6.2, an unauthenticated attacker can read arbitrary files from the system using a Path Traversal vulnerability in the /read-file endpoint handler.

References

github.com/advisories/GHSA-rq9r-qvwg-829q
github.com/erxes/erxes
github.com/erxes/erxes/commit/d626070a0fcd435ae29e689aca051ccfb440c2f3
nvd.nist.gov/vuln/detail/CVE-2024-57186
www.sonarsource.com/blog/micro-services-major-headaches-detecting-vulnerabilities-in-erxes-microservices

Code Behaviors & Features

Detect and mitigate CVE-2024-57186 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →