Stimulsoft Dashboard.JS directory traversal vulnerability

CRITICAL 9.8CVE-2024-24398 · GHSA-gfqf-9w98-7jmx · Published 06/02/2024 · updated 09/07/2026

In short

CVE-2024-24398 is a CRITICAL (CVSS 9.8) vulnerability affecting dashboards.php (stimulsoft), stimulsoft-dashboards-js.
Chance of exploitation in the next 30 days (EPSS): 2.0%, higher than 81.0% of all vulnerabilities.
Fix: update to 2024.1.2, 2024.1.3 or later.

Package	Affected versions	Patched versions
dashboards.php stimulsoft	`< 2024.1.2`	`2024.1.2`
stimulsoft-dashboards-js npm	`< 2024.1.3`	`2024.1.3`

Description

Directory Traversal vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.3 allows a remote attacker to execute arbitrary code via a crafted payload to the fileName parameter of the Save function.

NVD description

Directory Traversal vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrary code via a crafted payload to the fileName parameter of the Save function.

References

nvd.nist.gov/vuln/detail/CVE-2024-24398 · ADVISORY
cloud-trustit.spp.at/s/Pi78FFazHamJQ5R · WEB
cves.at/posts/cve-2024-24398/writeup · WEB
stimulsoft/Dashboards.JS · PACKAGE
stimulsoft.com · WEB
cves.at/posts/cve-2024-24398/writeup · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free