CVE-2024-11136
CVE-2024-11136 is a high-severity vulnerability with a CVSS 4.0 base score of 8.2. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-35.
Key facts
- Severity: High (CVSS 4.0 base score 8.2)
- EPSS exploit prediction: 0% (16th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2024-33673
- Weakness: CWE-35
- Published:
- Last modified:
Description
The default TCL Camera application exposes a provider vulnerable to path traversal vulnerability. Malicious application can supply malicious URI path and delete arbitrary files from user’s external storage.
Frequently asked questions
- What is CVE-2024-11136?
- The default TCL Camera application exposes a provider vulnerable to path traversal vulnerability. Malicious application can supply malicious URI path and delete arbitrary files from user’s external storage.
- How severe is CVE-2024-11136?
- CVE-2024-11136 has a CVSS 4.0 base score of 8.2, rated high severity.
- Is CVE-2024-11136 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (16th percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2024-11136?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- Does CVE-2024-11136 have an EU (EUVD) identifier?
- Yes. CVE-2024-11136 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-33673.
- When was CVE-2024-11136 published?
- CVE-2024-11136 was published on 2024-11-14 and last updated on 2026-06-17.
References
- https://blog.oversecured.com/Content-Providers-and-the-potential-weak-spots-they-can-have/#path-traversal-when-using-data-from-uri
- https://cert.pl/en/posts/2024/11/CVE-2024-11136/
- https://cert.pl/posts/2024/11/CVE-2024-11136/
Other CWE-35 vulnerabilities
- CVE-2025-59793 — Critical (CVSS 9.9): Rocket TRUfusion Enterprise through 7.10.5 exposes the endpoint at /axis2/services/WsPortalV6UpDwAxis2Impl to…
- CVE-2026-6074 — Critical (CVSS 9.8): Intrado 911 Emergency Gateway (EGW) 5.x, 6.x, and 7.x contain a path traversal vulnerability in the…
- CVE-2025-41723 — Critical (CVSS 9.8): The importFile SOAP method is vulnerable to a directory traversal attack. An unauthenticated remote attacker bypass the…
- CVE-2025-42937 — Critical (CVSS 9.8): SAP Print Service (SAPSprint) performs insufficient validation of path information provided by users. An…
- CVE-2025-30515 — Critical (CVSS 9.8): CyberData 011209 Intercom could allow an authenticated attacker to upload arbitrary files to multiple locations…
- CVE-2026-52703 — Critical (CVSS 9.6): Unauthenticated Path Traversal in FastDup <= 2.7.2 versions.