PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-40646 vertex-app CVE debrief

A path traversal vulnerability in Vertex, a management tool for Private Tracker (PT) users, allows unauthorized file system access. The vulnerability exists in versions prior to commit fbde301b97986d5913fc4bc95f5445750d282e11. The CVSS 3.1 score of 8.6 (HIGH) reflects network attackability with no required privileges or user interaction, yielding high confidentiality impact and low integrity/availability impact. The weakness is categorized as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Vendor
vertex-app
Product
vertex
CVSS
HIGH 8.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-01
Original CVE updated
2026-07-22
Advisory published
2026-06-01
Advisory updated
2026-07-22

Who should care

Organizations and individuals operating Vertex instances for Private Tracker media management, particularly those with internet-exposed deployments.

Technical summary

Vertex versions prior to commit fbde301b97986d5913fc4bc95f5445750d282e11 are vulnerable to path traversal (CWE-22). An unauthenticated remote attacker can exploit this to access files outside the intended directory scope. The vulnerability is rated HIGH (CVSS 8.6) due to high confidentiality impact with no required authentication or user interaction. The fix is available in the referenced commit.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade Vertex to a version containing commit fbde301b97986d5913fc4bc95f5445750d282e11 or later.
  • If immediate patching is not feasible, restrict network access to the Vertex application to trusted hosts only.
  • Monitor application logs for anomalous file access patterns or directory traversal indicators.
  • Review file system permissions to ensure the application service account has minimal necessary access.

Evidence notes

The CVE description and NVD record confirm path traversal in Vertex versions before the specified commit. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) supports the HIGH severity rating. The GitHub advisory and commit provide patch provenance.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-40646 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-40646

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-40646 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-40646

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.