CVE-2024-49760: OpenRefine has a path traversal in LoadLanguageCommand
Last updated 10 February 2025
Other sources
OpenRefine is a free, open source tool for working with messy data. The load-language command expects a lang parameter from which it constructs the path of the localization file to load, of the form translations-$LANG.json. But when doing so in versions prior to 3.8.3, it does not check that the resulting path is in the expected directory, which means that this command could be exploited to read other JSON files on the file system. Version 3.8.3 addresses this issue.
— MITRE
The load-language command expects a lang parameter from which it constructs the path of the localization file to load, of the form translations-$LANG.json. When doing so, it does not check that the resulting path is in the expected directory, which means that this command could be exploited to read other JSON files on the file system.
The command should be patched by checking that the normalized path is in the expected directory.
— GitHub
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-49760?
CVE-2024-49760 is classified with a moderate severity level due to its potential impact on data localization.
How can I fix CVE-2024-49760?
To address CVE-2024-49760, you should upgrade to OpenRefine version 3.8.3 or later.
What is affected by CVE-2024-49760?
CVE-2024-49760 affects OpenRefine versions up to 3.8.3, including all installations of the software.
What kind of issues does CVE-2024-49760 present?
CVE-2024-49760 can lead to improper loading of localization files, potentially exposing applications to localization errors.
Is CVE-2024-49760 actively being exploited?
As of now, there is no public information indicating that CVE-2024-49760 is being actively exploited.