CVE-2024-5926
CVE-2024-5926 is a critical-severity vulnerability in Stitionai Devika with a CVSS 3.x base score of 9.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-29.
Key facts
- Severity: Critical (CVSS 3.x base score 9.1)
- EPSS exploit prediction: 1% (54th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2024-47055
- Weakness: CWE-29
- Affected product: Stitionai Devika
- Published:
- Last modified:
Description
A path traversal vulnerability in the get-project-files functionality of stitionai/devika allows attackers to read arbitrary files from the filesystem and cause a Denial of Service (DoS). This issue is present in all versions of the application. The vulnerability arises due to insufficient path sanitization for the 'project-name' parameter, enabling attackers to specify paths that traverse the filesystem. By setting 'project-name' to the root directory, an attacker can cause the application to attempt to read the entire filesystem, leading to a DoS condition.
Frequently asked questions
- What is CVE-2024-5926?
- A path traversal vulnerability in the get-project-files functionality of stitionai/devika allows attackers to read arbitrary files from the filesystem and cause a Denial of Service (DoS). This issue is present in all versions of the application. The vulnerability arises due to insufficient path sanitization for the 'project-name' parameter, enabling attackers to specify paths that traverse the filesystem. By setting 'project-name' to the root directory, an attacker can cause the application to attempt to read the entire filesystem, leading to a DoS condition.
- How severe is CVE-2024-5926?
- CVE-2024-5926 has a CVSS 3.x base score of 9.1, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability high.
- Is CVE-2024-5926 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (54th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2024-5926?
- CVE-2024-5926 affects Stitionai Devika. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2024-5926?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
- Does CVE-2024-5926 have an EU (EUVD) identifier?
- Yes. CVE-2024-5926 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-47055.
- When was CVE-2024-5926 published?
- CVE-2024-5926 was published on 2024-06-30 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:stitionai:devika:*:*:*:*:*:*:*:*
More vulnerabilities in Stitionai Devika
- CVE-2024-40422 — Critical (CVSS 9.1): The snapshot_path parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to a path…
- CVE-2024-5820 — High (CVSS 8.8): An unprotected WebSocket connection in the latest version of stitionai/devika (commit ecee79f) allows a malicious…
- CVE-2024-5549 — High (CVSS 8.1): A CORS misconfiguration in the stitionai/devika repository allows attackers to steal sensitive information such as…
- CVE-2024-5712 — High (CVSS 8.1): A Cross-Site Request Forgery (CSRF) vulnerability was identified in the stitionai/devika application, affecting the…
- CVE-2024-6331 — High (CVSS 7.5): stitionai/devika main branch as of commit cdfb782b0e634b773b10963c8034dc9207ba1f9f is vulnerable to Local File Read…
- CVE-2024-5548 — High (CVSS 7.5): A directory traversal vulnerability exists in the stitionai/devika repository, specifically within the…
All CVEs affecting Stitionai Devika →
Other CWE-29 vulnerabilities
- CVE-2025-15036 — Critical (CVSS 10.0): A path traversal vulnerability exists in the `extract_archive_to_dir` function within the…
- CVE-2024-2083 — Critical (CVSS 9.9): A directory traversal vulnerability exists in the zenml-io/zenml repository, specifically within the /api/v1/steps…
- CVE-2024-6396 — Critical (CVSS 9.8): A vulnerability in the `_backup_run` function in aimhubio/aim version 3.19.3 allows remote attackers to overwrite any…
- CVE-2024-5443 — Critical (CVSS 9.8): CVE-2024-4320 describes a vulnerability in the parisneo/lollms software, specifically within the…
- CVE-2024-2358 — Critical (CVSS 9.8): A path traversal vulnerability in the '/apply_settings' endpoint of parisneo/lollms-webui allows attackers to execute…
- CVE-2023-6975 — Critical (CVSS 9.8): A malicious user could use this issue to get command execution on the vulnerable machine and get access to data &…