CVE-2024-55550

Mitel MiCollab contains a path traversal vulnerability (CWE-22) caused by insufficient input sanitization of file-path input. It is triggered when an authenticated user with administrative privileges submits crafted paths that escape the intended directory, allowing the attacker to read local files on the MiCollab server. On its own the flaw requires admin credentials, but it can be chained with CVE-2024-41713, an unauthenticated remote arbitrary file-read flaw in the same product, enabling remote attackers to read files without valid credentials. Any organization running Mitel MiCollab is affected; the available data does not specify affected or fixed version ranges. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2025-01-07 with known ransomware use, although no public proof-of-concept is known.

What to do: Apply Mitel's updates or mitigations per the vendor advisory immediately, prioritizing internet-facing MiCollab servers, and address the chained CVE-2024-41713 issue in the same maintenance cycle; where mitigations are unavailable, restrict or discontinue use per CISA KEV guidance. Check the Mitel advisory for exact fixed versions (not provided here), limit administrative access to trusted users, and review server logs for evidence of arbitrary file reads or follow-on ransomware activity.