CVE-2024-48766
High
Description
NetAlertX 24.7.18 before 24.10.12 allows unauthenticated file reading because an HTTP client can ignore a redirect, and because of factors related to strpos and directory traversal, as exploited in the wild in May 2025. This is related to components/logs.php.
SeverityHigh
CVSS8.6
Exploit probability99. percentile67.9%
ProductNetalertx
PublishedMay 13, 2025
First seenMay 13, 2025
Weakness typeCWE-698CWE-698
How to fix
Update
- netalertx netalertx24.10.12 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| netalertx netalertx | 24.7.18 ≤ v < 24.10.12 | 24.10.12 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.