CVE-2024-36527

MEDIUM NUCLEI

Puppeteer-Renderer <3.2.0 - Path Traversal

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2024-36527. PoCs published by bigb0x. A Nuclei detection template is also available.

AI-analyzed exploit summary The repository contains a functional Python script that exploits CVE-2024-36527, a directory traversal vulnerability in puppeteer-renderer v3.2.0 and earlier. The exploit sends a crafted request to read sensitive files (e.g., /etc/passwd) via the file protocol in the URL parameter.

Description

puppeteer-renderer v.3.2.0 and before is vulnerable to Directory Traversal. Attackers can exploit the URL parameter using the file protocol to read sensitive information from the server.

Exploits (1)

nomisec WORKING POC 1 stars
by bigb0x · poc
https://github.com/bigb0x/CVE-2024-36527

The repository contains a functional Python script that exploits CVE-2024-36527, a directory traversal vulnerability in puppeteer-renderer v3.2.0 and earlier. The exploit sends a crafted request to read sensitive files (e.g., /etc/passwd) via the file protocol in the URL parameter.

Classification
Working Poc 95%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: puppeteer-renderer v3.2.0 and earlier
No auth needed
Prerequisites: Network access to the target server · puppeteer-renderer endpoint exposed
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Nuclei Templates (1)

Puppeteer Renderer - Directory Traversal
MEDIUMVERIFIEDby Stux

References (1)

Core 1

Scores

CVSS v3 6.5
EPSS 0.0258
EPSS Percentile 83.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-22
Status published
Published Jun 17, 2024
Tracked Since Feb 18, 2026