What is the CVSS score of CVE-2024-57186?

CVE-2024-57186 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.5%.

Which versions of Erxes are affected by CVE-2024-57186?

CVE-2024-57186 presents moderate security risk, a path traversal vulnerability rated CVSS 5.4. This could allow unauthorized file access. Proof-of-concept code is publicly available.. A patch is available.

Is there a public PoC exploit available for CVE-2024-57186?

Yes, a public proof-of-concept exploit is available for CVE-2024-57186. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2024-57186?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Review file handling controls.

Erxes CVE-2024-57186

EUVD-2025-17795 MEDIUM

Path Traversal (CWE-22)

2025-06-10 cve@mitre.org

GHSA-rq9r-qvwg-829q

Path Traversal Erxes

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 19:49 euvd

EUVD-2025-17795

Analysis Generated

Mar 14, 2026 - 19:49 vuln.today

Patch released

Mar 14, 2026 - 19:49 nvd

Patch available

PoC Detected

Jun 20, 2025 - 13:08 vuln.today

Public exploit code

CVE Published

Jun 10, 2025 - 17:19 nvd

MEDIUM 5.4

DescriptionCVE.org

In Erxes <1.6.2, an unauthenticated attacker can read arbitrary files from the system using a Path Traversal vulnerability in the /read-file endpoint handler.

Analysis

In Erxes <1.6.2, an unauthenticated attacker can read arbitrary files from the system using a Path Traversal vulnerability in the /read-file endpoint handler.

Technical ContextAI

Path traversal allows an attacker to access files outside the intended directory by manipulating file paths with sequences like '../'.

RemediationAI

A vendor patch is available — apply it immediately. Validate and sanitize file path inputs. Use a whitelist of allowed files or directories. Implement chroot jails or containerization.

CVE-2024-57186 vulnerability details – vuln.today

Back