OpenRefine has a path traversal in LoadLanguageCommand
Summary
OpenRefine has a path traversal in LoadLanguageCommand
Original description
The description as published by the source.
OpenRefine is a free, open source tool for working with messy data. The load-language command expects a lang parameter from which it constructs the path of the localization file to load, of the form translations-$LANG.json. But when doing so in versions prior to 3.8.3, it does not check that the resulting path is in the expected directory, which means that this command could be exploited to read other JSON files on the file system. Version 3.8.3 addresses this issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2024-49760 openrefine Fixed in: 3.6.2-2+deb12u3
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com