What is the CVSS score of CVE-2024-57189?

CVE-2024-57189 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Erxes are affected by CVE-2024-57189?

CVE-2024-57189 presents moderate security risk, a path traversal vulnerability rated CVSS 5.4. This could allow unauthorized file access. Proof-of-concept code is publicly available.. A patch is available.

Is there a public PoC exploit available for CVE-2024-57189?

Yes, a public proof-of-concept exploit is available for CVE-2024-57189. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2024-57189?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Review file handling controls.

Erxes CVE-2024-57189

EUVD-2024-54663 MEDIUM

Path Traversal (CWE-22)

2025-06-10 cve@mitre.org

GHSA-2977-5php-6789

Path Traversal Erxes

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 19:49 euvd

EUVD-2024-54663

Analysis Generated

Mar 14, 2026 - 19:49 vuln.today

Patch released

Mar 14, 2026 - 19:49 nvd

Patch available

PoC Detected

Jun 20, 2025 - 13:08 vuln.today

Public exploit code

CVE Published

Jun 10, 2025 - 17:20 nvd

MEDIUM 5.4

DescriptionCVE.org

In Erxes <1.6.2, an authenticated attacker can write to arbitrary files on the system using a Path Traversal vulnerability in the importHistoriesCreate GraphQL mutation handler.

Analysis

In Erxes <1.6.2, an authenticated attacker can write to arbitrary files on the system using a Path Traversal vulnerability in the importHistoriesCreate GraphQL mutation handler.

Technical ContextAI

Path traversal allows an attacker to access files outside the intended directory by manipulating file paths with sequences like '../'.

RemediationAI

A vendor patch is available — apply it immediately. Validate and sanitize file path inputs. Use a whitelist of allowed files or directories. Implement chroot jails or containerization.

CVE-2024-57189 vulnerability details – vuln.today

Back