CVE-2024-49381: 
Linux openSUSE vulnerability analysis and mitigation

Plenti, a static site generator, contains an arbitrary file deletion vulnerability (CVE-2024-49381) in versions prior to 0.7.2. The vulnerability exists in the /postLocal endpoint when a plenti user serves their website (GitHub Advisory, NVD).

The vulnerability is present in the /postLocal endpoint of Plenti's serve command. When processing file operations, the endpoint fails to properly validate file paths before deletion operations, leading to potential arbitrary file deletion. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (NVD).

This vulnerability can lead to information loss through unauthorized file deletion when a Plenti user serves their website. An attacker could potentially delete arbitrary files on the system where Plenti is running (GitHub Advisory).

Users should upgrade to Plenti version 0.7.2 or later, which contains the fix for this vulnerability. The fix ensures that the /postLocal endpoint is properly contained to the project directory (GitHub Release).