CVE-2024-45190

Published: Aug 23, 2024Modified: Oct 10, 2025

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: reefs@jfrog.com (Secondary)

Description

Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal in the "Pipeline Interaction" request

Affected (1)

Products: Mage: Mage Ai

Mage

1 product

Mage Ai

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Mage Mage Ai	All versions

Related CWEs

CWE-35

Path Traversal: '.../...//'

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.

References (1)

https://research.jfrog.com/vulnerabilities/mage-ai-pipeline-interaction-request-remote-arbitrary-file-leak-jfsa-2024-001039605/

Source: reefs@jfrog.com

ExploitThird Party Advisory

Timeline

No history available yet.