CVE-2024-0341 is a low severity (CVSS 3.5) path traversal weakness in Inis. No fixed version is confirmed in the record, so check the vendor or project page. The record says an exploit has been disclosed to the public. It is not listed as exploited in the wild by CISA.
What's affected
Inis up to and including 2.0.1. The affected file is app/api/controller/default/File.php, in the GET request handler, and the manipulated argument is path.
The weakness is mapped to CWE-24, path traversal, and CWE-22, path traversal. The record was published on 2024-01-09. The record's KEV flag is false, so CISA does not list it in the Known Exploited Vulnerabilities catalog.
How to check if you're exposed
This is software you install yourself or an appliance, so start from your own inventory. Find where the product runs, read its version from the application, its package metadata or its install directory, and compare it to the range above.
grep -ril "'+d['short'].split('-')[0]+'" /var/www 2>/dev/null
That searches a typical web root for the product name, so adjust the path to your server. For code you maintain, search for the file and parameter named in the record and read how the value is used.
You can also paste a manifest or SBOM into the free in-browser scanner at Safeguard Gold to see which known CVEs apply to your dependencies. It only covers components that appear in a manifest or SBOM, so a standalone appliance still needs the manual check.
What to do now
- Find every deployment of Inis in your environment, including test systems and anything bought or installed by a team outside IT.
- Check the vendor or project page for a fixed release. None is confirmed in the record, so do not assume that upgrading to the latest version resolves it until the notes say so.
- Run the web server as a user that can read only the files the app needs.
- Keep secrets, configuration files and backups outside the web root.
- Block requests that contain traversal sequences at a proxy as a stop gap.
- Re-run a scan after the change and record the date, so you can show the exposure is closed.
Why it matters
Path traversal happens when a file path is built from user input and the application does not stop sequences that climb out of the intended folder. The caller can then read files that were never meant to be served.
The fix is to resolve the final path and confirm it still sits inside the intended directory, or better, to map user input to file identifiers rather than file names.
The CVSS vector reads as follows. The attack is possible from an adjacent network, attack complexity is low, privileges required are low, and user interaction is not needed. The impact on confidentiality, integrity and availability is limited, no and no respectively. A score is a starting point. Your own exposure, meaning whether the product faces the internet and what it can reach, decides the real priority.
Quick check
Is this vulnerability known to be exploited in the wild?
The record's KEV flag is false, so CISA does not list it in the Known Exploited Vulnerabilities catalog. The description says an exploit has been disclosed to the public, which is not the same as confirmed attacks. Treat the public disclosure as a reason to act sooner.
Which versions are fixed?
The record does not confirm a fixed version, and the vendor reference could not be retrieved. Check the vendor or project page, and if none is available, restrict access to the product or replace it.
Sources
The vendor and researcher references listed in the NVD record could not be retrieved when this post was written, so the details above come from the NVD record itself.
Last reviewed: 19 October 2026.
