Path Traversal and Object Injection Vulnerability in Element Pack Pro

CVE-2024-33568

Summary

The vulnerability in BdThemes Element Pack Pro arises from an improper limitation of pathname to a restricted directory, commonly known as Path Traversal, combined with the deserialization of untrusted data. This flaw allows attackers to bypass directory restrictions, potentially facilitating unauthorized access to sensitive files on the server. The affected versions, from n/a up to 7.7.4, may also expose the system to object injection attacks, making it imperative for users to apply security patches and implement best practices to safeguard their installations.

References