CVE-2024-22050
Iodine Static File Server Path Traversal Vulnerability
Path traversal in the static file service in Iodine less than 0.7.33 allows an unauthenticated, remote attacker to read files outside the public folder via malicious URLs.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Path traversal in the static file service in Iodine less than 0.7.33 allows an unauthenticated, remote attacker to read files outside the public folder via malicious URLs.
- Record
CVE-2024-22050- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List
Iodine Static File Server Path Traversal Vulnerability
Path traversal in the static file service in Iodine less than 0.7.33 allows an unauthenticated, remote attacker to read files outside the public folder via malicious URLs.
- Record
CVE-2024-22050- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2019-0692
Path traversal in the static file service in Iodine less than 0.7.33 allows an unauthenticated, remote attacker to read files outside the public folder via malicious URLs.
- Record
EUVD-2019-0692- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-85rf-xh54-whp3
Malicious URL drafting attack against iodines static file server may allow path traversal
Impact
A path traversal vulnerability was detected in iodine's static file service. This vulnerability effects any application running iodine's static file server on an effected iodine version.
Malicious URL drafting may cause the static file server to attempt a response containing data from files that shouldn't be normally accessible from the public folder.
Patches
The vulnerability was patched in version 0.7.34. Please upgrade to the latest version.
Workarounds
A possible workaround would be to disable the static file service and it's X-Sendfile support, sending static files using nginx or a source code solution (sending the data dynamically).
However, it would be better to upgrade iodine to the latest version, as it also contains non-security related fixes.
For more information
If you have any questions or comments about this advisory:
- Email Boaz Segev
- Record
GHSA-85rf-xh54-whp3- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
Iodine Static File Server Path Traversal Vulnerability
Path traversal in the static file service in Iodine less than 0.7.33 allows an unauthenticated, remote attacker to read files outside the public folder via malicious URLs.
- Record
CVE-2024-22050- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVGHSA-85rf-xh54-whp3
Malicious URL drafting attack against iodines static file server may allow path traversal
Impact
A path traversal vulnerability was detected in iodine's static file service. This vulnerability effects any application running iodine's static file server on an effected iodine version.
Malicious URL drafting may cause the static file server to attempt a response containing data from files that shouldn't be normally accessible from the public folder.
Patches
The vulnerability was patched in version 0.7.34. Please upgrade to the latest version.
Workarounds
A possible workaround would be to disable the static file service and it's X-Sendfile support, sending static files using nginx or a source code solution (sending the data dynamically).
However, it would be better to upgrade iodine to the latest version, as it also contains non-security related fixes.
For more information
If you have any questions or comments about this advisory:
- Email Boaz Segev
- Record
GHSA-85rf-xh54-whp3- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
iodineRubyGems |
before 0.7.34 | 0.7.34 |
iodineRubyGems |
before 0.7.34, plus listed versions 0.0.10.0.20.0.30.0.40.1.0 Show 45 moreShow less0.1.10.1.110.1.120.1.130.1.140.1.150.1.160.1.170.1.180.1.190.1.20.1.200.1.210.1.30.1.40.1.50.1.60.1.70.1.80.1.90.2.00.2.10.2.100.2.110.2.120.2.130.2.140.2.150.2.160.2.170.2.20.2.30.2.40.2.50.2.60.2.70.2.80.2.90.3.00.3.10.3.20.3.30.3.40.3.50.3.6 |
0.7.34 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-22050 is a high vulnerability (CVSS 7.5) in Boazsegev Iodine, published October 7, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.92%, the 60th percentile. Fixed in iodine 0.7.34.
References
github.com/boazsegev/iodine/security/advisories/GHSA-85rf-xh54-whp3
vulncheck.com/advisories/vc-advisory-GHSA-85rf-xh54-whp3
nvd.nist.gov/vuln/detail/CVE-2024-22050
rubygems.org
Left out here: 60 versions. The JSON record has them.