Start FileCloud FREE Trial
Log in

Advisory 2024-12/05 Node.js Vulnerability

December 13, 2024

Vulnerability type

Bypass of network import restrictions, arbitrary code execution

Severity factors

This vulnerability has a CVSS severity rating of 6.5 medium.

Versions affectedFileCloud versions 23.241.4 and earlier are affected.
Version fixedFileCloud version 23.241.5 and later


Description

In Node.js, a bypass of network import restrictions vulnerability may enable attackers to execute arbitrary code.


Fix

FileCloud version 23.241.5.28040 upgrades Node.js to version 18.20.5 to fix this vulnerability.

What you should do to fix this vulnerability

  • If you are using FileCloud Server, we recommended that you update to the latest version, which is 23.241.5.28040 or greater. 
    Note: Hotfixes applied after updating FileCloud to version 23.241.4 must be reapplied after upgrading to version 23.241.5.

  • If you are using FileCloud Online, your site will be upgraded to the latest version on December 14 through December 15.

If you have any questions about this advisory, please contact FileCloud support.