{"id":"CVE-2024-36117","aliases":["EUVD-2024-2674","GHSA-82j3-hf72-7x93","GHSA-w7c4-5w4f-jm3g"],"status":"published","title":"Path traversal while serving Reposilite javadoc expanded files","description":"Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. Reposilite v3.5.10 is affected by an Arbitrary File Read vulnerability via path traversal while serving expanded javadoc files. Reposilite has addressed this issue in version 3.5.12. There are no known workarounds for this vulnerability. This issue was discovered and reported by the GitHub Security lab and is also tracked as GHSL-2024-074.","severity":{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.03119,"percentile":0.87995,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2024-06-19T17:37:24Z","modified":"2026-10-28T02:30:57Z","exploits":[{"source":"nuclei","id":"CVE-2024-36117","title":"Reposilite \u003e= 3.3.0, \u003c 3.5.12 - Arbitrary File Read","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-36117.yaml"}],"fixes":[{"ecosystem":"Maven","package":"com.reposilite:reposilite-backend","fixed_in":["3.5.12"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.reposilite:reposilite-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.5.12"}]}]},{"source":"osv","ecosystem":"Maven","package":"com.reposilite:reposilite-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.5.12"}]}]}],"products":[{"vendor":"dzikoysk","product":"reposilite"},{"vendor":"reposilite","product":"reposilite"}],"references":[{"url":"https://github.com/dzikoysk/reposilite/releases/tag/3.5.12","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","web"]},{"url":"https://github.com/dzikoysk/reposilite/security/advisories/GHSA-82j3-hf72-7x93","tags":["x_refsource_MISC","Exploit","Mitigation","Vendor Advisory","advisory","web"]},{"url":"https://github.com/dzikoysk/reposilite/commit/e172ae4b539c822d0d6e04cf090713c7202a79d6","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36117","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-82j3-hf72-7x93"},{"url":"https://github.com/advisories/GHSA-w7c4-5w4f-jm3g"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/36xxx/CVE-2024-36117.json","tags":["advisory"]},{"url":"https://github.com/dzikoysk/reposilite","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-36117","title":"Path traversal while serving Reposilite javadoc expanded files","description":"Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. Reposilite v3.5.10 is affected by an Arbitrary File Read vulnerability via path traversal while serving expanded javadoc files. Reposilite has addressed this issue in version 3.5.12. There are no known workarounds for this vulnerability. This issue was discovered and reported by the GitHub Security lab and is also tracked as GHSL-2024-074.","status":"published","published":"2024-06-19T17:37:24.404Z","modified":"2024-11-04T18:25:47.436Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:34:14.649724Z"}],"euvd":[{"id":"EUVD-2024-2674","description":"Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. Reposilite v3.5.10 is affected by an Arbitrary File Read vulnerability via path traversal while serving expanded javadoc files. Reposilite has addressed this issue in version 3.5.12. There are no known workarounds for this vulnerability. This issue was discovered and reported by the GitHub Security lab and is also tracked as GHSL-2024-074.","status":"published","published":"2024-06-19T17:37:24Z","modified":"2024-11-04T18:25:47Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-03T00:05:11.811805Z"}],"ghsa":[{"id":"GHSA-82j3-hf72-7x93","title":"Reposilite vulnerable to path traversal while serving javadoc expanded files (arbitrary file read) (`GHSL-2024-074`)","description":"### Summary\nReposilite v3.5.10 is affected by an Arbitrary File Read vulnerability via path traversal while serving expanded javadoc files.\n\n### Details\nThe problem lies in the way how the expanded javadoc files are served. The `GET /javadoc/{repository}/\u003cgav\u003e/raw/\u003cresource\u003e` route uses the `\u003cresource\u003e` path parameter to find the file in the `javadocUnpackPath` directory and returns it's content to the user.\n\n[JavadocFacade.kt#L77](https://github.com/dzikoysk/reposilite/blob/68b73f19dc9811ccf10936430cf17f7b0e622bd6/reposilite-backend/src/main/kotlin/com/reposilite/javadocs/JavadocFacade.kt#L77):\n\n```kotlin\nfun findRawJavadocResource(request: JavadocRawRequest): Result\u003cJavadocRawResponse, ErrorResponse\u003e =\n   with (request) {\n       mavenFacade.canAccessResource(accessToken, repository, gav)\n           .flatMap { javadocContainerService.loadContainer(accessToken, repository, gav) }\n           .filter({ Files.exists(it.javadocUnpackPath.resolve(resource.toString())) }, { notFound(\"Resource $resource not found\") })\n           .map {\n               JavadocRawResponse(\n                   contentType = supportedExtensions[resource.getExtension()] ?: ContentType.APPLICATION_OCTET_STREAM,\n                   content = Files.newInputStream(it.javadocUnpackPath.resolve(resource.toString()))\n               )\n           }\n   }\n```\n\nIn this case, the `\u003cresource\u003e` path parameter can contain path traversal characters such as `/../../`. Since the path is concatenated with the main directory, it opens the possibility to read files outside the `javadocUnpackPath` directory.\n\n#### Impact\n\nThis issue may lead to Arbitrary File Read on the server. A potential attacker can read some sensitive file, such as `reposilite.db`, that contains the sqlite database used by Reposilite. This database contains the sensitive information used by Reposilite, including passwords and hashes of issued tokens. Also, the `configuration.cdn` file can be read, which contains other sensitive properties.\n\n### Steps to reproduce\n\n1. Start the Reposilite instance on http://localhost:8080/\n2. Find at least one javadoc file in the hosted repositories. For example, the default test workspace contains the `/releases/javadoc/1.0.0/javadoc-1.0.0-javadoc.jar` archive that is suitable for our attack.\n3. Send a GET request to http://127.0.0.1:8080/javadoc/releases/javadoc/1.0.0/raw/%2e%2e%5c%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2freposilite.db\nWhen this request is processed on the server, Reposilite tries to unpack the `/repositories/releases/javadoc/1.0.0/javadoc-1.0.0-javadoc.jar` file into the `/javadocs/releases/javadoc/1.0.0/.cache/unpack` folder. Then, it tries to read the `../../../../../../reposilite.db` file from this folder, which triggers the path traversal attack.\n\n![image](https://github.com/dzikoysk/reposilite/assets/44605151/2f2638e2-2b6a-498d-9ca3-bacc84041d8a)\n\n### Remediation\n\nNormalize (remove all occurrences of `/../`) the `\u003cresource\u003e` path parameter before using it when reading the file. For example:\n\n```kotlin\ncontent = Files.newInputStream(it.javadocUnpackPath.resolve(resource.toPath()))\n```\n\nChanging `resource.toString()` to `resource.toPath()` is enough here as the `com.reposilite.storage.api.Location#toPath` method normalizes the string internally.\n","status":"published","published":"2024-11-04T23:23:08Z","modified":"2024-11-04T23:23:09Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:38:16.477822Z"},{"id":"GHSA-w7c4-5w4f-jm3g","title":"Duplicate Advisory: Reposilite Arbitrary File Read vulnerability","description":"## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-82j3-hf72-7x93. This link is maintained to preserve external references.\n\n## Original description\nReposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. Reposilite v3.5.10 is affected by an Arbitrary File Read vulnerability via path traversal while serving expanded javadoc files. Reposilite has addressed this issue in version 3.5.12. There are no known workarounds for this vulnerability. This issue was discovered and reported by the GitHub Security lab and is also tracked as GHSL-2024-074.","status":"withdrawn","published":"2024-08-05T21:29:27Z","modified":"2024-11-05T16:19:43Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:38:16.477822Z"}],"nvd":[{"id":"CVE-2024-36117","description":"Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. Reposilite v3.5.10 is affected by an Arbitrary File Read vulnerability via path traversal while serving expanded javadoc files. Reposilite has addressed this issue in version 3.5.12. There are no known workarounds for this vulnerability. This issue was discovered and reported by the GitHub Security lab and is also tracked as GHSL-2024-074.","status":"published","published":"2024-06-19T18:15:11.22Z","modified":"2026-06-17T07:36:08.33Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:10:07.173605Z"}],"osv":[{"id":"CVE-2024-36117","title":"Path traversal while serving Reposilite javadoc expanded files","description":"Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. Reposilite v3.5.10 is affected by an Arbitrary File Read vulnerability via path traversal while serving expanded javadoc files. Reposilite has addressed this issue in version 3.5.12. There are no known workarounds for this vulnerability. This issue was discovered and reported by the GitHub Security lab and is also tracked as GHSL-2024-074.","status":"published","published":"2024-06-19T17:37:24.404Z","modified":"2026-10-28T02:30:57.73094318Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:44:40.704083Z"},{"id":"GHSA-82j3-hf72-7x93","title":"Reposilite vulnerable to path traversal while serving javadoc expanded files (arbitrary file read) (`GHSL-2024-074`)","description":"### Summary\nReposilite v3.5.10 is affected by an Arbitrary File Read vulnerability via path traversal while serving expanded javadoc files.\n\n### Details\nThe problem lies in the way how the expanded javadoc files are served. The `GET /javadoc/{repository}/\u003cgav\u003e/raw/\u003cresource\u003e` route uses the `\u003cresource\u003e` path parameter to find the file in the `javadocUnpackPath` directory and returns it's content to the user.\n\n[JavadocFacade.kt#L77](https://github.com/dzikoysk/reposilite/blob/68b73f19dc9811ccf10936430cf17f7b0e622bd6/reposilite-backend/src/main/kotlin/com/reposilite/javadocs/JavadocFacade.kt#L77):\n\n```kotlin\nfun findRawJavadocResource(request: JavadocRawRequest): Result\u003cJavadocRawResponse, ErrorResponse\u003e =\n   with (request) {\n       mavenFacade.canAccessResource(accessToken, repository, gav)\n           .flatMap { javadocContainerService.loadContainer(accessToken, repository, gav) }\n           .filter({ Files.exists(it.javadocUnpackPath.resolve(resource.toString())) }, { notFound(\"Resource $resource not found\") })\n           .map {\n               JavadocRawResponse(\n                   contentType = supportedExtensions[resource.getExtension()] ?: ContentType.APPLICATION_OCTET_STREAM,\n                   content = Files.newInputStream(it.javadocUnpackPath.resolve(resource.toString()))\n               )\n           }\n   }\n```\n\nIn this case, the `\u003cresource\u003e` path parameter can contain path traversal characters such as `/../../`. Since the path is concatenated with the main directory, it opens the possibility to read files outside the `javadocUnpackPath` directory.\n\n#### Impact\n\nThis issue may lead to Arbitrary File Read on the server. A potential attacker can read some sensitive file, such as `reposilite.db`, that contains the sqlite database used by Reposilite. This database contains the sensitive information used by Reposilite, including passwords and hashes of issued tokens. Also, the `configuration.cdn` file can be read, which contains other sensitive properties.\n\n### Steps to reproduce\n\n1. Start the Reposilite instance on http://localhost:8080/\n2. Find at least one javadoc file in the hosted repositories. For example, the default test workspace contains the `/releases/javadoc/1.0.0/javadoc-1.0.0-javadoc.jar` archive that is suitable for our attack.\n3. Send a GET request to http://127.0.0.1:8080/javadoc/releases/javadoc/1.0.0/raw/%2e%2e%5c%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2freposilite.db\nWhen this request is processed on the server, Reposilite tries to unpack the `/repositories/releases/javadoc/1.0.0/javadoc-1.0.0-javadoc.jar` file into the `/javadocs/releases/javadoc/1.0.0/.cache/unpack` folder. Then, it tries to read the `../../../../../../reposilite.db` file from this folder, which triggers the path traversal attack.\n\n![image](https://github.com/dzikoysk/reposilite/assets/44605151/2f2638e2-2b6a-498d-9ca3-bacc84041d8a)\n\n### Remediation\n\nNormalize (remove all occurrences of `/../`) the `\u003cresource\u003e` path parameter before using it when reading the file. For example:\n\n```kotlin\ncontent = Files.newInputStream(it.javadocUnpackPath.resolve(resource.toPath()))\n```\n\nChanging `resource.toString()` to `resource.toPath()` is enough here as the `com.reposilite.storage.api.Location#toPath` method normalizes the string internally.\n","status":"published","published":"2024-11-04T23:23:08Z","modified":"2024-11-05T16:26:59.15522Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"},{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:41.732368Z"},{"id":"GHSA-w7c4-5w4f-jm3g","title":"Duplicate Advisory: Reposilite Arbitrary File Read vulnerability","description":"## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-82j3-hf72-7x93. This link is maintained to preserve external references.\n\n## Original description\nReposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. Reposilite v3.5.10 is affected by an Arbitrary File Read vulnerability via path traversal while serving expanded javadoc files. Reposilite has addressed this issue in version 3.5.12. There are no known workarounds for this vulnerability. This issue was discovered and reported by the GitHub Security lab and is also tracked as GHSL-2024-074.","status":"withdrawn","published":"2024-08-05T21:29:27Z","modified":"2026-09-10T03:50:55.486771319Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"},{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:58.401149Z"}]}}