CVE-2024-57189: Erxes Path Traversal vulnerability

June 10, 2025 (updated November 10, 2025)

In Erxes <1.6.2, an authenticated attacker can write to arbitrary files on the system using a Path Traversal vulnerability in the importHistoriesCreate GraphQL mutation handler.

References

github.com/advisories/GHSA-2977-5php-6789
github.com/erxes/erxes
github.com/erxes/erxes/commit/d626070a0fcd435ae29e689aca051ccfb440c2f3
nvd.nist.gov/vuln/detail/CVE-2024-57189
www.sonarsource.com/blog/micro-services-major-headaches-detecting-vulnerabilities-in-erxes-microservices

Code Behaviors & Features

Detect and mitigate CVE-2024-57189 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →