Cyber Resilience

CVE-2024-40646

HighPublic PoCUpdated

Published: 01 June 2026

Published
01 June 2026
Modified
17 June 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
EPSS Score 0.0041 33.2th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2024-40646 is a high-severity Path Traversal (CWE-22) vulnerability in Vertex-App Vertex. Its CVSS base score is 8.6 (High).

Operationally, ranked at the 33.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability details

Vertex is a management tool for PT (Private Tracker) users to manage streaming and watching videos. Versions prior to commit fbde301b97986d5913fc4bc95f5445750d282e11 are vulnerable to path traversal. Users should upgrade to a version containing commit fbde301b97986d5913fc4bc95f5445750d282e11 to receive a patch.

CWE(s)
CWE-22

Related Threats

CVEs Like This One

CVE-2026-24970Shared CWE-22
CVE-2025-24406Shared CWE-22
CVE-2020-36939Shared CWE-22
CVE-2026-27523Shared CWE-22
CVE-2026-24848Shared CWE-22
CVE-2026-44243Shared CWE-22
CVE-2025-2505Shared CWE-22
CVE-2026-4350Shared CWE-22
CVE-2026-5841Shared CWE-22
CVE-2026-33242Shared CWE-22

Affected Assets

vertex-app
vertex
≤ 2024-07-17

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SI-10 Information Input Validation
addresses: CWE-22

Validates pathnames and filenames to prevent traversal outside intended directories.

References