{"id":"CVE-2024-55926","aliases":["EUVD-2024-52850","GHSA-99jw-x78w-3hcm"],"status":"published","title":"Arbitrary file upload, deletion and read through header manipulation","description":"A vulnerability found in Xerox Workplace Suite allows arbitrary file read, upload, and deletion on the server through crafted header manipulation. By exploiting improper validation of headers, attackers can gain unauthorized access to data","severity":{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00436,"percentile":0.38377,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22","CWE-434"],"published":"2025-01-23T17:12:21Z","modified":"2026-06-17T08:11:27Z","products":[{"vendor":"xerox","product":"workplace_suite"},{"vendor":"xerox","product":"xerox workplace suite"}],"references":[{"url":"https://securitydocs.business.xerox.com/wp-content/uploads/2025/01/Xerox-Security-Bulletin-XRX25-002-for-Xerox%C2%AE-WorkplaceSuite%C2%AE.pdf","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-55926"},{"url":"https://securitydocs.business.xerox.com/wp-content/uploads/2025/01/Xerox-Security-Bulletin-XRX25-002-for-Xerox%C2%AE-Workplace-Suite%C2%AE.pdf"},{"url":"https://github.com/advisories/GHSA-99jw-x78w-3hcm"}],"sources":{"cve":[{"id":"CVE-2024-55926","title":"Arbitrary file upload, deletion and read through header manipulation","description":"A vulnerability found in Xerox Workplace Suite allows arbitrary file read, upload, and deletion on the server through crafted header manipulation. By exploiting improper validation of headers, attackers can gain unauthorized access to data","status":"published","published":"2025-01-23T17:12:21.371Z","modified":"2025-02-24T17:11:02.567Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-434","CWE-22"],"updated_at":"2026-11-02T14:34:22.525279Z"}],"euvd":[{"id":"EUVD-2024-52850","description":"A vulnerability found in Xerox Workplace Suite allows arbitrary file read, upload, and deletion on the server through crafted header manipulation. By exploiting improper validation of headers, attackers can gain unauthorized access to data","status":"published","published":"2025-01-23T17:12:21Z","modified":"2025-02-24T17:11:02Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T20:53:25.075327Z"}],"ghsa":[{"id":"GHSA-99jw-x78w-3hcm","title":"Arbitrary file upload, deletion and read through header manipulation","description":"Arbitrary file upload, deletion and read through header manipulation","status":"published","published":"2025-01-23T18:31:20Z","modified":"2025-01-29T12:32:46Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:59:42.771987Z"}],"nvd":[{"id":"CVE-2024-55926","description":"A vulnerability found in Xerox Workplace Suite allows arbitrary file read, upload, and deletion on the server through crafted header manipulation. By exploiting improper validation of headers, attackers can gain unauthorized access to data","status":"published","published":"2025-01-23T18:15:31.78Z","modified":"2026-06-17T08:11:27.777Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-22","CWE-434"],"updated_at":"2026-11-02T14:10:42.895329Z"}]}}