CISA urges software devs to weed out path traversal vulnerabilities

CISA and the FBI issued a Secure by Design alert urging software manufacturers to eliminate directory traversal (path traversal) vulnerabilities after recent exploitation in critical infrastructure; the notice cites CVE-2024-1708 and CVE-2024-20345 and links exploitation to ransomware campaigns (Black Basta, Bl00dy) that chained traversal with authentication bypasses to deliver Cobalt Strike and LockBit variants, and recommends concrete mitigations for developers.