CVE-2024-31454

What it is

PsiTransfer is an open source, self-hosted file sharing solution. Prior to version 2.2.0, the absence of restrictions on the endpoint, which is designed for uploading files, allows an attacker who received the id of a file distribution to change the files that are in this distribution. The vulnerability allows an attacker to influence those users who come to the file distribution after them and slip the victim files with a malicious or phishing signature. Version 2.2.0 contains a patch for this issue. CVE-2024-31454 allows users to violate the integrity of a file that is uploaded by another user. In this case, additional files are not loaded into the file bucket. Violation of integrity at the level of individual files. While the vulnerability with the number CVE-2024-31453 allows users to violate the integrity of a file bucket without violating the integrity of files uploaded by other users. Thus, vulnerabilities are reproduced differently, require different security recommendations and affect different objects of the application’s business logic.

At a glance

Exploitability

Can be exploited over the network without logging in, but needs a user to act. High risk of data tampering.

Exploit odds

0.5% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2024-04-09 18:15 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-06-17 07:28 UTC Last updatedMost recent change to the record

Why it ranks here

• Exploited in the wild: no, CISA does not list it.
• Exploit odds: 0.5% in the next 30 days (EPSS).
• Severity: 6.5 MEDIUM (CVSS).
• Fix: a patch or advisory is linked.

Details

Published

2024-04-09 18:15 UTC

Last modified

2026-06-17 07:28 UTC

Exploit probability

0.5% · EPSS, next 30 days

Weakness

CWE-434 · Unrestricted file upload

Record status

Deferred

Attack profile CVSS 3.1 · 6.5

Attack vector

Network

Complexity

Low

Privileges needed

None

User interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Is it in your code?

Hand this to your coding agent. It searches your project for the affected products and checks versions. Nothing leaves your machine.

Read https://cve-list.com/agent/cve/CVE-2024-31454.md and follow it. Check whether this project is affected by CVE-2024-31454. Read only. Don't change anything and don't upload my code. Tell me yes, no or not sure, with the file as proof.

Copy as ticket · More options · Status badge