# CVE-2024-27292: Docassemble - Path Traversal

> Live exploitation tracking for CVE-2024-27292 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2024-27292

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 7.5
- **Public exploit available:** Yes
- **Affected products:** Jhpyle Docassemble
- **Weaknesses:** CWE-706 (Use of Incorrectly-Resolved Name or Reference)
- **Tags:** web_application

## Description

Docassemble is an expert system for guided interviews and document assembly. The vulnerability allows attackers to gain unauthorized access to information on the system through URL manipulation.

## CrowdSec analysis

[CVE-2024-27292](https://euvd.enisa.europa.eu/vulnerability/CVE-2024-27292) is a vulnerability in Docassemble, an expert system for guided interviews and document assembly, where attackers can manipulate URLs to gain unauthorized access to sensitive information on the system.

CrowdSec has been tracking this vulnerability and its exploits since 31st of March 2025.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2024-27292 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting.
CrowdSec data also reveals a clear uptick in attacks involving CVE-2024-27292 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Exploitation attempts generally involve requests to URLs containing `/interview` coupled with specific query manipulations.

## Timeline

- 2024-02-29: CVE Published. CVE-2024-27292 is published to NVD.
- 2025-03-31: Rule Released. CrowdSec releases a rule to detect CVE-2024-27292 exploitation attempts against the CrowdSec Network.
- 2025-03-31: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2024-27292 for the first time.

## References

- https://github.com/jhpyle/docassemble/security/advisories/GHSA-jq57-3w7p-vwvv
- https://github.com/jhpyle/docassemble/commit/97f77dc486a26a22ba804765bfd7058aabd600c9
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-27292.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2024-27292) follows observed exploitation activity for CVE-2024-27292. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.