D-Tale Remote Code Execution via Custom Filter Input (CVE-2024-55890)
D-Tale versions before 3.16.1 reportedly contained a remote code execution vulnerability in the update-settings endpoint that allowed attackers to enable custom filters and execute arbitrary code on publicly hosted instances.
What happened
D-Tale versions before 3.16.1 contained a vulnerability in the update-settings endpoint that allowed attackers to enable custom filters and execute arbitrary code on the server.
The vulnerability used improper neutralization of user-controllable input during web page generation, classified as CWE-79 cross-site scripting.
Reported impact
Users hosting D-Tale publicly could be vulnerable to remote code execution allowing attackers to run malicious code on the server.
Index analysis
The vulnerability was patched in version 3.16.1 by blocking the ability for users to update the enable_custom_filters flag through the update-settings endpoint.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.