High severity7.7NVD Advisory· Published Oct 30, 2024· Updated Apr 15, 2026

CVE-2024-48735

Description

Directory Traversal in /SASStudio/sasexec/sessions/{sessionID}/workspace/{InternalPath} in SAS Studio 9.4 allows remote attacker to access internal files by manipulating default path during file download. NOTE: this is disputed by the vendor because these filesystem paths are allowed for authorized users.

Affected products

Sas/SAS Studiollm-fuzzy
Range: 9.4

Patches

Vulnerability mechanics

References

sas.comnvd
github.com/ACN-CVEs/CVE-2024-48735/blob/67e86e12393650e1df16c845ceff487d016f31f0/LFI.pdfnvd

News mentions

No linked articles in our index yet.

cvss	0.501
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000