PatchTheCVECVE-2024-1099: A vulnerability was found in Rebuild up to 3.5.5
CVE-2024-1099 is a low-severity flaw (CVSS 3.5) affecting rebuild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A vulnerability was found in Rebuild up to 3.5.5. It has been classified as problematic. Affected is the function getFileOfData of the file /filex/read-raw. The manipulation of the argument url leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252456.
Why this priority
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 3.5 (Low) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | Required |
| EPSS exploit chance | 0.6% (top 51%) |
| CISA exploited list | No |
| Weakness | CWE-79 |
| Published | 2024-01-31 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2024-1099?
rebuild: upgrade to newer than 3.5.5. Exact commands for each OS are on this page.
Is CVE-2024-1099 being exploited?
CVE-2024-1099 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2024-1099 affect?
CVE-2024-1099 affects rebuild. Severity is low (CVSS 3.5). A vulnerability was found in Rebuild up to 3.5.5. It has been classified as problematic. Affected is the function getFileOfData of the file /filex/read-raw. The manipulation of the argument url leads to cross site scripting. It is possible
How urgent is CVE-2024-1099?
Priority 30/100. Public exploit reference
Related CVEs
- CVE-2024-25294 CRITICAL 9.1 DOWNGRADE An SSRF issue in REBUILD v.3.5 allows a remote attacker to obtain sensitive information and execute arbitrary
- CVE-2025-50900 CRITICAL 9.8 UPGRADE An issue was discovered in getrebuild/rebuild 4.0.4
- CVE-2025-28056 CRITICAL 9.8 UPGRADE rebuild v3.9.0 through v3.9.3 has a SQL injection vulnerability in /admin/admin-cli/exec component.
- CVE-2024-46413 MEDIUM 5.1 UPGRADE Rebuild v3.7.7 was discovered to contain a Server-Side Request Forgery (SSRF) via the type parameter in the co
- CVE-2024-1098 MEDIUM 4.3 UPGRADE A vulnerability was found in Rebuild up to 3.5.5 and classified as problematic