CVE-2024-50334: high-severity vulnerability in Erudika scoold
Semicolon Path Injection on API /api;/config
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
58Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 8.7epss 1.0%
from disclosure to weapon
Published on NVDOct 29
VulnCheck+261d
Scoold is a Q&A and a knowledge sharing platform for teams. A semicolon path injection vulnerability was found on the /api;/config endpoint. By appending a semicolon in the URL, attackers can bypass authentication and gain unauthorised access to sensitive configuration data. Furthermore, PUT requests on the /api;/config endpoint while setting the Content-Type: application/hocon header allow unauthenticated attackers to file reading via HOCON file inclusion. This allows attackers to retrieve sensitive information such as configuration files from the server, which can be leveraged for further exploitation. The vulnerability has been fixed in Scoold 1.64.0. A workaround would be to disable the Scoold API with scoold.api_enabled = false.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
Erudika · scooldRelated CVEs — Erudika scoold
In the same product, most dangerous first.
CVE-2026-54676MEDIUMScoold: GET /api/posts/{id}/answers leaks private-space replies when personal API tokens are enabledEPSS 0.4%CVE-2026-54677MEDIUMScoold: Authenticated user can post replies and comments to private-space questions without space membershipEPSS 0.4%CVE-2026-34832MEDIUMScoold: Cross-Account Feedback Deletion (IDOR)EPSS 0.3%CVE-2026-42176MEDIUMScoold: Persistent Admin Takeover by Overwriting the admins Configuration Setting via Forged JWT (missing `jti` validation)EPSS 0.3%CVE-2026-57183MEDIUMScoold: Forged JWT Accepted as Admin API Token Allowing Unauthorized Access to Sensitive Configuration and LogsEPSS 0.3%CVE-2026-55840MEDIUMScoold: Open Redirect in getBackToUrl() allows phishing via domain-prefix startsWith bypassEPSS 0.3%