CVE-2024-55416

DevDojo Voyager, a widely used open-source admin panel package for Laravel (PHP), is vulnerable to reflected cross-site scripting (CWE-79) in its /admin/compass route through version 1.8.0. The attack is triggered when an authenticated, high-privileged user (e.g., an admin) is tricked into clicking an attacker-crafted link that injects a malicious payload into the affected page. Arbitrary JavaScript then executes in the victim's browser within the trusted admin context, allowing the attacker to perform actions in the admin panel or capture data on the page. Any site or application running Voyager 1.8.0 or earlier with its admin panel reachable by users is affected. There is no confirmed in-the-wild exploitation yet (not in CISA KEV), but a public writeup with proof-of-concept details from SonarSource exists, and the 20.3% EPSS probability (97th percentile) suggests a heightened near-term exploitation risk.

What to do: Upgrade Voyager to the latest release (a version after 1.8.0) to obtain the XSS fix. In the meantime, restrict access to the Voyager admin panel (e.g., trusted networks or VPN), and have admins avoid clicking links to /admin/compass from untrusted sources. Check web access logs for requests to /admin/compass containing unexpected parameters or scripts as a sign of targeted exploitation.