{"cve":"CVE-2024-31450","nvd":{"published":"2024-04-19T19:15:06.873","modified":"2026-06-17T07:28:26.983","status":"Analyzed","description":"Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. The Owncast application exposes an administrator API at the URL /api/admin. The emoji/delete endpoint of said API allows administrators to delete custom emojis, which are saved on disk. The parameter name is taken from the JSON request and directly appended to the filepath that points to the emoji to delete. By using path traversal sequences (../), attackers with administrative privileges can exploit this endpoint to delete arbitrary files on the system, outside of the emoji directory. This vulnerability is fixed in 0.1.3.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","score":6.5},"cwes":["CWE-22"],"references":["https://github.com/owncast/owncast/blob/v0.1.2/controllers/admin/emoji.go#L63","https://github.com/owncast/owncast/commit/1b14800c7d7f54be14ed4d130bfe7f480645076e","https://github.com/owncast/owncast/releases/tag/v0.1.3","https://securitylab.github.com/advisories/GHSL-2023-277_Owncast/","https://github.com/owncast/owncast/blob/v0.1.2/controllers/admin/emoji.go#L63"],"products":["owncast_project:owncast"],"source":"nvd","synced_at":"2026-10-19T21:49:08.435428910+00:00"},"epss":{"cve":"CVE-2024-31450","score":0.00969,"percentile":0.61876,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-9355-27m8-h74v","url":"https://osv.dev/vulnerability/GHSA-9355-27m8-h74v","summary":"Owncast Path Traversal vulnerability","modified":"2024-11-18T16:27:00Z","packages":[{"ecosystem":"Go","name":"github.com/owncast/owncast","purl":"pkg:golang/github.com/owncast/owncast","ranges":["<0.1.3"],"fixed":["0.1.3"]}]},{"id":"GO-2024-2741","url":"https://osv.dev/vulnerability/GO-2024-2741","summary":"Owncast Path Traversal vulnerability in github.com/owncast/owncast","modified":"2026-03-03T04:51:48.424163Z","packages":[{"ecosystem":"Go","name":"github.com/owncast/owncast","purl":"pkg:golang/github.com/owncast/owncast","ranges":["<0.1.3"],"fixed":["0.1.3"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}