CISA says 'no more' to decades-old directory traversal bugs

CISA urges the software industry to eliminate directory traversal vulnerabilities after recent high-profile exploits (e.g., CVE-2024-1708 and CVE-2024-20345), warning these flaws enable data theft and broader system compromise—including impacts to critical infrastructure and cloud services—and recommending known mitigations such as random file identifiers, filename character restrictions, and removing executable permissions from uploaded files.