{"cve":"CVE-2024-22204","nvd":{"published":"2024-01-23T18:15:18.467","modified":"2026-06-17T07:10:56.153","status":"Modified","description":"Whoogle Search is a self-hosted metasearch engine. Versions 0.8.3 and prior have a limited file write vulnerability when the configuration options in Whoogle are enabled. The `config` function in `app/routes.py` does not validate the user-controlled `name` variable on line 447 and `config_data` variable on line 437. The `name` variable is insecurely concatenated in `os.path.join`, leading to path manipulation. The POST data from the `config_data` variable is saved with `pickle.dump` which leads to a limited file write. However, the data that is saved is earlier transformed into a dictionary and the `url` key value pair is added before the file is saved on the system. All in all, the issue allows us to save and overwrite files on the system that the application has permissions to, with a dictionary containing arbitrary data and the `url` key value, which is a limited file write. Version 0.8.4 contains a patch for this issue.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","score":5.3},"cwes":["CWE-22"],"references":["https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L419-L452","https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L437","https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L444","https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L447","https://github.com/benbusby/whoogle-search/commit/3a2e0b262e4a076a20416b45e6b6f23fd265aeda"],"products":["benbusby:whoogle_search"],"source":"nvd","synced_at":"2026-10-19T21:44:57.175229480+00:00"},"epss":{"cve":"CVE-2024-22204","score":0.00757,"percentile":0.55202,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-hh2q-qv66-jcqg","url":"https://osv.dev/vulnerability/GHSA-hh2q-qv66-jcqg","summary":"Whoogle Search Path Traversal vulnerability","modified":"2024-03-14T20:56:47.899719Z","packages":[{"ecosystem":"PyPI","name":"whoogle-search","purl":"pkg:pypi/whoogle-search","ranges":["<0.8.4"],"fixed":["0.8.4"]}]},{"id":"PYSEC-2024-23","url":"https://osv.dev/vulnerability/PYSEC-2024-23","summary":"","modified":"2026-06-10T17:02:51.008351664Z","packages":[{"ecosystem":"PyPI","name":"whoogle-search","purl":"pkg:pypi/whoogle-search","ranges":["<0.8.4"],"fixed":["0.8.4"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}