GCVE - cpe:2.3:a:thecontrolgroup:voyager:*:*:*:*:*:laravel:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:thecontrolgroup:voyager:*:*:*:*:*:laravel:*:*

part: a version: * update: *

Vendor	Thecontrolgroup (`d928be1b-6544-57ed-b812-acb2931490b5`)
Product	Voyager (`4666b194-9ffc-52c4-a8e1-817d2df202af`)
Edition	*
Language	*
Software edition	*
Target software	laravel
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-55417`	vulnerable	2026-06-08 06:54:16.997267	Details available DevDojo Voyager through version 1.8.0 is vulnerable to bypassing the file type verification when an authenticated user uploads a file via /admin/media/upload. An authenticated user can upload a web shell causing arbitrary code execution on the server. Published: 2025-01-30T00:00:00.000Z Updated: 2026-02-26T19:08:54.673Z Open on db.gcve.eu Reference links https://github.com/thedevdojo/voyager/blob/1.6/src/Http/Controllers/VoyagerMediaController.php#L238 https://www.sonarsource.com/blog/the-tainted-voyage-uncovering-voyagers-vulnerabilities/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-55416`	vulnerable	2026-06-08 06:54:16.996850	Details available DevDojo Voyager through version 1.8.0 is vulnerable to reflected XSS via /admin/compass. By manipulating an authenticated user to click on a link, arbitrary Javascript can be executed. Published: 2025-01-30T00:00:00.000Z Updated: 2025-02-06T14:55:34.341Z Open on db.gcve.eu Reference links https://github.com/thedevdojo/voyager/blob/1.6/src/Http/Controllers/VoyagerCompassController.php#L44 https://github.com/thedevdojo/voyager/blob/1.6/resources/views/master.blade.php#L132 https://www.sonarsource.com/blog/the-tainted-voyage-uncovering-voyagers-vulnerabilities/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-55415`	vulnerable	2026-06-08 06:54:16.996370	Details available DevDojo Voyager through 1.8.0 is vulnerable to path traversal at the /admin/compass. Published: 2025-01-30T00:00:00.000Z Updated: 2025-02-06T14:40:50.378Z Open on db.gcve.eu Reference links https://github.com/thedevdojo/voyager/blob/1.6/src/Http/Controllers/VoyagerCompassController.php#L44 https://github.com/thedevdojo/voyager/blob/1.6/src/Http/Controllers/VoyagerCompassController.php#L213 https://www.sonarsource.com/blog/the-tainted-voyage-uncovering-voyagers-vulnerabilities/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-36070`	vulnerable	2026-06-08 05:25:02.443051	Details available Insecure Permission vulnerability found in Yoyager v.1.4 and before allows a remote attacker to execute arbitrary code via a crafted .php file to the media component. Published: 2023-04-26T00:00:00.000Z Updated: 2025-02-03T16:57:42.672Z Open on db.gcve.eu Reference links https://github.com/the-control-group/voyager/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-17050`	vulnerable	2026-06-08 05:13:09.815616	Details available An issue was discovered in the Voyager package through 1.2.7 for Laravel. An attacker with admin privileges and Compass access can read or delete arbitrary files, such as the .env file. NOTE: a software maintainer has suggested a solution in which Compass is switched off in a production environment. Published: 2019-09-30T18:51:51.000Z Updated: 2024-08-05T01:33:15.778Z Open on db.gcve.eu Reference links https://github.com/the-control-group/voyager/issues/4322	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Voyager

Notes

PURL mappings

Vulnerability references

Contribute