Skip to content
OpenAdvisories

Vendor

vendure-ecommerce

2 known vulnerabilities.

Products

vendure 2
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.1
    CVE-2024-48914 Public exploit Scanner template EPSS 60%

    Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy

    Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbit…

    vendure-ecommerce vendure @vendure/asset-server-plugin npm