CVE-2024-36117

Nuclei

Path traversal while serving Reposilite javadoc expanded files

Title source: CVE List
STIX 2.1 vulnerability

Record summary

EIP currently links 1 Nuclei template to CVE-2024-36117.

Description

Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. Reposilite v3.5.10 is affected by an Arbitrary File Read vulnerability via path traversal while serving expanded javadoc files. Reposilite has addressed this issue in version 3.5.12. There are no known workarounds for this vulnerability. This issue was discovered and reported by the GitHub Security lab and is also tracked as GHSL-2024-074.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Oct 17, 2025 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 20, 2024 · Source: CVE List

Affected products and versions

3
ProductSourceVersion range

reposilite

Browse dzikoysk / reposilite

Default status: unknown

CVE List3.3.0 to < 3.5.12affected
>= 3.3.0, < 3.5.12affected

reposilite

Browse reposilite / reposilite
VulnCheckVersion data not supplied

com.reposilite:reposilite-backend

Browse Maven / com.reposilite:reposilite-backend
GitHub Advisory3.3.0 to < 3.5.12 · Fixed in 3.5.12affected

Nuclei templates

1
ProjectDiscoveryHIGHReposilite >= 3.3.0, < 3.5.12 - Arbitrary File ReadCVSS 8.6

Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. Reposilite v3.5.10 is affected by an Arbitrary File Read vulnerability via path traversal while serving expanded javadoc files. Reposilite has addressed this issue in version 3.5.12. There are no known workarounds for this vulnerability. This issue was discovered and reported by the GitHub Security lab and is also tracked as GHSL-2024-074.

Impact

Unauthenticated attackers can exploit path traversal to read arbitrary files including the reposilite.db database file.

Remediation

Update Reposilite to version 3.5.12 or later.

WeaknessesCWE-22
Authorsiamnoooob, rootxharsh, pdresearch
Template tagscvecve2024reposilitelfivkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Shodan: http.favicon.hash:1212523028
https://github.com/advisories/GHSA-82j3-hf72-7x93 https://github.com/dzikoysk/reposilite/commit/e172ae4b539c822d0d6e04cf090713c7202a79d6 https://github.com/dzikoysk/reposilite/releases/tag/3.5.12 https://github.com/dzikoysk/reposilite/security/advisories/GHSA-82j3-hf72-7x93 https://nvd.nist.gov/vuln/detail/CVE-2024-36117

Source: ProjectDiscovery

References

5