{"id":"CVE-2024-40445","aliases":["EUVD-2025-12274","GHSA-4qhj-jmx7-8mr8","UBUNTU-CVE-2024-40445"],"status":"published","title":"Directory Traversal vulnerability in forkosh Mime Tex before v.1.77 allows an attacker to execute...","description":"A directory traversal vulnerability in forkosh Mime TeX before version 1.77 allows attackers on Windows systems to read or append arbitrary files by manipulating crafted input paths.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00635,"percentile":0.50715,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-77"],"published":"2025-04-22T00:00:00Z","modified":"2026-06-17T07:45:53Z","exploits":[{"source":"pocgithub","id":"TaiYou-TW/CVE-2024-40445_CVE-2024-40446","title":"TaiYou-TW/CVE-2024-40445_CVE-2024-40446","date":"2025-04-21","url":"https://github.com/TaiYou-TW/CVE-2024-40445_CVE-2024-40446"}],"products":[{"vendor":"ctan","product":"mimetex"}],"references":[{"url":"https://github.com/Oefenweb/mimetex/blob/master/mimetex.c#L12414-L12423","tags":["Product"]},{"url":"https://youtu.be/W2KPHFNfgrg","tags":["Broken Link"]},{"url":"https://youtu.be/OII16TteaJw","tags":["Broken Link"]},{"url":"https://github.com/TaiYou-TW/CVE-2024-40445_CVE-2024-40446/","tags":["Mitigation","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-40445"},{"url":"https://github.com/TaiYou-TW/CVE-2024-40445_CVE-2024-40446","tags":["report"]},{"url":"https://github.com/advisories/GHSA-4qhj-jmx7-8mr8"},{"url":"https://ubuntu.com/security/CVE-2024-40445","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-40445","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-40445","description":"A directory traversal vulnerability in forkosh Mime TeX before version 1.77 allows attackers on Windows systems to read or append arbitrary files by manipulating crafted input paths.","status":"published","published":"2025-04-22T00:00:00Z","modified":"2025-04-30T15:38:33.378Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"adp"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:34:06.811965Z"}],"euvd":[{"id":"EUVD-2025-12274","description":"A directory traversal vulnerability in forkosh Mime TeX before version 1.77 allows attackers on Windows systems to read or append arbitrary files by manipulating crafted input paths.","status":"published","published":"2025-04-22T00:00:00Z","modified":"2025-04-30T15:38:33Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T20:51:59.026225Z"}],"ghsa":[{"id":"GHSA-4qhj-jmx7-8mr8","title":"Directory Traversal vulnerability in forkosh Mime Tex before v.1.77 allows an attacker to execute...","description":"Directory Traversal vulnerability in forkosh Mime Tex before v.1.77 allows an attacker to execute arbitrary code via a crafted file upload","status":"published","published":"2025-04-22T15:30:52Z","modified":"2025-04-22T21:31:46Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:01:59.626328Z"}],"nvd":[{"id":"CVE-2024-40445","description":"A directory traversal vulnerability in forkosh Mime TeX before version 1.77 allows attackers on Windows systems to read or append arbitrary files by manipulating crafted input paths.","status":"published","published":"2025-04-22T14:15:24.173Z","modified":"2026-06-17T07:45:53.32Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:10:46.40251Z"}],"osv":[{"id":"UBUNTU-CVE-2024-40445","description":"A directory traversal vulnerability in forkosh Mime TeX before version 1.77 allows attackers on Windows systems to read or append arbitrary files by manipulating crafted input paths.","status":"withdrawn","published":"2025-04-22T14:15:00Z","modified":"2026-03-14T08:54:29.960034Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T16:54:54.69008Z"}]}}