Security Resilience

CVE-2024-6433

Path Traversal

Path Traversal
Published
10 July 2024
Modified
15 April 2026
CVSS Score v3 7.5
Click a component to see what it means
Raw vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0056 46th percentile
Risk Priority 58 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2024-6433 is a high-severity Relative Path Traversal (CWE-23) vulnerability. Its CVSS base score is 7.5 (High).

Operationally, ranked at the 46th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and AC-3 (Access Enforcement) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability Data

The application zips all the files in the folder specified by the user, which allows an attacker to read arbitrary files on the system by providing a crafted path. This vulnerability can be exploited by sending a request to the…

more

application with a malicious snapshot_path parameter.

CWE(s)
CWE-23

Related Threats

CVEs Like This One

CVE-2025-62187Shared CWE-23
CVE-2026-20081Shared CWE-23
CVE-2026-101024Shared CWE-23
CVE-2023-3940Shared CWE-23
CVE-2025-57403Shared CWE-23
CVE-2026-33494Shared CWE-23
CVE-2025-62498Shared CWE-23
CVE-2025-58078Shared CWE-23
CVE-2023-3941Shared CWE-23
CVE-2026-57988Shared CWE-23

Affected Assets

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V5.3.2

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match

Explicit validation of path inputs stops .. sequences from ever being interpreted by the file system.

AC-3 Access Enforcement partial match

Access enforcement directly blocks unauthorized file reads/writes that result from unresolved .. sequences.

AC-4 Information Flow Enforcement partial match

Information-flow rules can be configured to reject traversals that would move data outside an approved directory boundary.

AC-6 Least Privilege partial match

Least privilege reduces the set of reachable files even when a traversal succeeds.

SA-8 Security and Privacy Engineering Principles partial match

Secure-engineering principles require safe pathname construction and input neutralization before any file operation.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
blocks

Secure SDLC practices directly require input validation and path sanitization that prevent relative traversal.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing in development catches path traversal via static/dynamic analysis, but does not itself implement the fix.

A.8.28 Secure coding partial match
prevents

Secure coding standards require neutralizing path traversal sequences, directly addressing CWE-23.

References