Description
DevDojo Voyager 是一个用于 Laravel 应用的后台管理面板。Voyager 通过 1.8.0 版本在 /admin/media/upload 接口中存在文件类型验证绕过漏洞。由于未正确验证上传文件的扩展名，经过身份认证的攻击者可以上传 PHP webshell 文件，从而在服务器上执行任意代码，获取服务器权限。
DevDojo Voyager /admin/media/upload 文件上传漏洞（CVE-2024-55417）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2024-55417
https://avd.aliyun.com/detail?id=AVD-2024-55417
https://www.sonarsource.com/blog/the-tainted-voyage-uncovering-voyagers-vulnerabilities/
https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-55417.yaml
https://thehackernews.com/2025/01/unpatched-php-voyager-flaws-leave.html
https://securityonline.info/cve-2024-55417-one-click-rce-vulnerability-in-voyager-admin-panel-no-patch/
https://cve.imfht.com/detail/CVE-2024-55417
https://security.snyk.io/vuln/SNYK-PHP-TCGVOYAGER-8675790
https://vuldb.com/iu/?id.294117