Chestnutcms vulnerabilities

3 known vulnerabilities in Chestnutcms from 1000mz. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Chestnutcms: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2024-57451Feb 3, 20251000mz

  ChestnutCMS <=1.5.0 has a directory traversal vulnerability in contentcore.controller.FileController#getFileList, which allows attackers to view any directory.

• 7.5 High severity

  Chestnutcms: Files or Directories Accessible to External Parties

  CVE-2024-57452Feb 3, 20251000mz

  ChestnutCMS <=1.5.0 has an arbitrary file deletion vulnerability in contentcore.controller.FileController, which allows attackers to delete any file and folder.

• 9.8 Critical severity

  Chestnutcms: Unrestricted Upload of File with Dangerous Type

  CVE-2024-56828Jan 6, 20251000mz

  File Upload vulnerability in ChestnutCMS through 1.5.0. Based on the code analysis, it was determined that the /api/member/avatar API endpoint receives a base64 string as input. This string is then passed to the memberService.uploadAvatarByBase64 method for pr