{"id":"CVE-2024-42054","details":"Cervantes through 0.5-alpha accepts insecure file uploads.","modified":"2026-08-12T03:51:40.945151619Z","published":"2024-07-28T00:00:00Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42054.json","cna_assigner":"mitre"},"references":[{"type":"WEB","url":"https://www.jinsonvarghese.com/stored-xss-file-upload-vulnerabilities-found-in-cervantes/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42054.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42054"},{"type":"FIX","url":"https://github.com/CervantesSec/cervantes/commit/78631a034d0fb3323a53fb7428b2022b29a0d2cd"},{"type":"ARTICLE","url":"https://www.getastra.com/blog/vulnerability/xss-insecure-file-cervantes/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/cervantessec/cervantes","events":[{"introduced":"b45d73382420aeef4802eae82abcbec3640d313f"},{"fixed":"78631a034d0fb3323a53fb7428b2022b29a0d2cd"}],"database_specific":{"extracted_events":[{"introduced":"0.3-alpha"},{"last_affected":"0.3-alpha"},{"introduced":"0.4-alpha"},{"last_affected":"0.4-alpha"},{"introduced":"0.5-alpha"},{"last_affected":"0.5-alpha"}],"source":["CPE_STRING","REFERENCES"],"cpe":["cpe:2.3:a:cervantessec:cervantes:0.3:alpha:*:*:*:*:*:*","cpe:2.3:a:cervantessec:cervantes:0.4:alpha:*:*:*:*:*:*","cpe:2.3:a:cervantessec:cervantes:0.5:alpha:*:*:*:*:*:*"]}}],"versions":["0.3-alpha","0.4-alpha","0.5-alpha"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-42054.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}]}