CVE-2024-3311 is a medium severity (CVSS 6.3) path traversal in Dreamer CMS up to 4.1.3.0, in the ZipUtils.unZipFiles function used by the themes controller. The record says upgrading to 4.1.3.1 fixes it. Upgrade Dreamer CMS to 4.1.3.1 or later.
What's affected
Dreamer CMS from iteachyou, up to and including 4.1.3.0. The affected code is the unZipFiles function in ZipUtils, called from the admin ThemesController. The record says the attack can be launched remotely and that an exploit is public.
The fix is version 4.1.3.1. We fetched the project release page on Gitee. Its message, in Chinese, says the release fixes known vulnerabilities and bugs and adds a click counter after static generation, and the underlying commit is dated 18 January 2024. The release note does not name this CVE, so rely on the NVD description for the link between them.
The record describes an attacker who can use the theme upload feature, which needs an admin account in the vector (PR:L).
The weakness class: CWE-22, path traversal. The NVD record scores it 6.3 (medium) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. CISA Known Exploited Vulnerabilities status in the record: not listed.
Source note: the description calls the issue critical (VulDB wording), while NVD scores it 6.3, Medium.
How to check if you're exposed
Find the version in the admin dashboard or in the project properties file. If the application is deployed from a build, check the jar or war file name and the build date. Anything at 4.1.3.0 or below is in range.
What to do now
- Upgrade Dreamer CMS to 4.1.3.1 or later and redeploy.
- Limit who has admin accounts, and use strong passwords with a second factor where possible.
- Restrict the admin path to internal networks.
- Review uploaded themes and the extraction directory for unexpected files.
Why it matters
The class is CWE-22, path traversal. Zip extraction is a famous place for it: if archive entry names are not checked, an entry named with parent directory sequences can land outside the target folder. Security folk call this zip slip. The record lists the CWE twice, a data quirk.
The fix pattern is to resolve each entry's final path and reject any that leave the destination directory. If you extract archives in your own code, check for that.
Quick check
What is the safe way to unzip uploaded archives?
Resolve the full destination path of every entry, check that it stays inside the target folder, and reject the archive otherwise. Also limit file counts and sizes, and extract with a low privilege account.
Sources
- Dreamer CMS 4.1.3.1 release on Gitee
- VulDB entry 259369 and a public write up on Gitee are listed in the record (not reviewed)
- Safeguard Gold entry for CVE-2024-3311
- Free in-browser dependency scan
Last reviewed: 19 October 2026.
