VYPR
← All advisories
Critical severity9.9NVD Advisory· Published May 14, 2024· Updated Apr 15, 2026

CVE-2024-4701

CVE-2024-4701

Description

A path traversal issue potentially leading to remote code execution in Genie for all versions prior to 4.3.18

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.netflix.genie:genie-webMaven
< 4.3.184.3.18

Patches

1
6bad017d8078

Amend the check on IllegalAttachmentFileNameException (#1217)

https://github.com/Netflix/genieBinbing HouMay 7, 2024via ghsa
commit
2 files changed · +3 −3
  • genie-web/src/main/java/com/netflix/genie/web/services/impl/LocalFileSystemAttachmentServiceImpl.java+2 −2 modified
    @@ -97,9 +97,9 @@ public Set<URI> saveAttachments(
 
                 if (filename != null) {
                     if ((filename.contains("/") || filename.contains("\\")
-                        || filename.equals(".") || filename.equals(".."))) {
+                        || filename.equals(".") || filename.contains(".."))) {
                         throw new IllegalAttachmentFileNameException("Attachment filename " + filename + " is illegal. "
-                            + "Filenames should not be . or .., or contain /, \\.");
+                            + "Filenames should not be ., or contain .., /, \\.");
                     }
 
                     final String attachmentCanonicalPath =
  • genie-web/src/test/groovy/com/netflix/genie/web/services/impl/LocalFileSystemAttachmentServiceImplSpec.groovy+1 −1 modified
    @@ -193,7 +193,7 @@ class LocalFileSystemAttachmentServiceImplSpec extends Specification {
         thrown(IllegalAttachmentFileNameException)
     }
 
-    def "reject attachments with illegal filename is .."() {
+    def "reject attachments with illegal filename containing .."() {
         Set<Resource> attachments = new HashSet<Resource>()
         Resource attachment = Mockito.mock(Resource.class)
         Mockito.doReturn("..").when(attachment).getFilename()

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

7

News mentions

0

No linked articles in our index yet.