CVE-2024-48914

CVE-2024-48914 is an unauthenticated path traversal flaw (CWE-22, CWE-20) in the asset server plugin of Vendure, an open-source headless commerce platform, with an additional denial-of-service vector in the same code path via a malformed URI. An attacker triggers it by sending a crafted request to the asset-serving endpoint whose URL contains traversal sequences (e.g., '/../'), requiring no privileges or user interaction (AV:N/AC:L/PR:N/UI:N). Successful exploitation lets the attacker read the contents of arbitrary files on the server, including configuration files and environment variables that may contain secrets, and can also crash the server (CVSS 3.1: 9.1 critical, C:H/A:H). Vendure deployments running the asset server plugin with versions prior to 3.0.5 (3.x series) or 2.3.3 (2.x series) are affected, while instances using object storage such as S3 or MinIO instead of the local file system are not exposed to the traversal. No public proof-of-concept or confirmed in-the-wild exploitation is known and it is not in CISA KEV, but the 60.4% EPSS score (99th percentile) indicates a high probability of exploitation within the next 30 days.

What to do: Upgrade to Vendure 3.0.5 (3.x line) or 2.3.3 (2.x line). If patching is delayed, either move asset storage to object storage such as S3 or MinIO, or add middleware that detects and blocks asset requests whose URLs contain '/../'. Also review server logs for traversal-pattern asset requests and, if arbitrary file reads are suspected, rotate secrets contained in environment variables and configuration files.