CVE-2024-41163

Veertu Anka Build version 1.42.0 contains a directory traversal vulnerability (CWE-22) in its archive functionality. An unauthenticated, remote attacker can send a specially crafted HTTP request to the Anka Build Cloud service that traverses outside the intended directory. Successful exploitation results in disclosure of sensitive information, effectively reading files outside the intended archive path, with high confidentiality impact but no integrity or availability impact per the CVSS 7.5 score. Any organization running Veertu Anka Build 1.42.0, typically deployed as private CI/CD infrastructure for macOS/iOS builds, is affected. A public proof-of-concept is available via Cisco Talos (TALOS-2024-2059), the issue is not yet in CISA KEV, and EPSS assigns a 52.5% probability of exploitation within 30 days (99th percentile), so defenders should treat exploitation risk as elevated.

What to do: Upgrade Anka Build to a release newer than 1.42.0 following Veertu's guidance for TALOS-2024-2059 / CVE-2024-41163, as no fixed version number is specified in the available data. Until upgraded, restrict network access to the Anka Build Cloud controller API to trusted hosts, since the flaw is triggered by an unauthenticated HTTP request. Review controller logs for suspicious requests to the archive endpoint and for evidence that sensitive files were retrieved.