DevDojo Voyager Arbitrary File Write

MEDIUM 4.3CVE-2024-55417 · GHSA-35p2-5vrh-m3p6 · Published 30/01/2025 · updated 17/06/2026

Package	Affected versions	Patched versions
tcg/voyager Packagist	`≤ 1.8.0`	No fix yet
voyager thecontrolgroup	`≤ 1.8.0`	No fix yet

Description

DevDojo Voyager through version 1.8.0 is vulnerable to bypassing the file type verification when an authenticated user uploads a file via /admin/media/upload. An authenticated user can upload a web shell causing arbitrary code execution on the server.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2024-55417 · ADVISORY
thedevdojo/voyager · PACKAGE
thedevdojo/voyager · WEB
sonarsource.com/blog/the-tainted-voyage-uncovering-voyagers-vulnerabilities · WEB
sonarsource.com/blog/the-tainted-voyage-uncovering-voyagers-vulnerabilities · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free