CVE-2024-5548

CVE-2024-5548 is a directory traversal vulnerability affecting the stitionai/devika repository's /api/download-project endpoint. Attackers can exploit this by manipulating the 'project_name' parameter in a GET request, allowing unauthorized download of arbitrary files due to insufficient input validation. With a CVSS score of 7.5 (HIGH), this vulnerability is easily exploitable over the network with low attack complexity, potentially leading to high confidentiality impact. There is currently no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.