CVE-2024-8694

5.1 mediumEPSS 0.8%

Medium (5.1) in heyewei jfinalcms. EPSS 0.8% chance of exploitation in the next 30 days.

A vulnerability, which was classified as problematic, was found in JFinalCMS up to 20240903. This affects the function update of the file /admin/template/update of the component com.cms.controller.admin.TemplateController. The manipulation of the argument fileName leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Severity

CVSS 4.0

5.1 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

CVSS 3.1

3.8 low

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 56% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2024-09-11
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

heyewei:jfinalcms

References

https://gitee.com/heyewei/JFinalcms/issues/IAOKSQ
https://github.com/wave-to/SomeCms/blob/main/JFinalCMS.md
https://vuldb.com/?ctiid.277167
https://vuldb.com/?id.277167
https://vuldb.com/?submit.401858

Check your stack JSON