CVE-2024-25466
React-Native-Documents Document Picker ≤ 9.1.1
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2024-25466 is a high-severity Path Traversal: '/dir/../filename' (CWE-26) vulnerability in React-Native-Documents Document Picker. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 42th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-0687
Vulnerability Data
Directory Traversal vulnerability in React Native Document Picker before v.9.1.1 and fixed in v.9.1.1 allows a local attacker to execute arbitrary code via a crafted script to the Android library component.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Input validation structurally stops untrusted path sequences from being used to construct filenames that escape the intended directory.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input validation and path sanitization that prevent this weakness.
Vulnerability identification processes will discover path traversal flaws during scanning or testing.
Hardened configuration baselines can enforce directory restrictions that reduce exploitability.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches path traversal via static/dynamic analysis and penetration testing.
Secure development lifecycle mandates input validation and path canonicalization that directly prevent directory traversal sequences.
Application security requirements explicitly call for controls against path traversal and other injection flaws.
Secure architecture principles reduce the attack surface but do not prescribe the specific coding fix.
Secure coding standards require neutralizing '../' sequences and canonicalizing paths before file operations.
Information access restriction limits which files can be reached, mitigating impact but not the root cause.