Loading...
Skip to main content
GeekWala

CVE-2024-29188 — Vulnerability in wix — CVE Details

HIGH

Malicious directory junction can cause WiX RemoveFoldersEx to possibly delete elevated files

Published March 25, 2024Updated September 10, 2026Source: osv

Summary

### Summary The custom action behind WiX's `RemoveFolderEx` functionality could allow a standard user to delete protected directories. ### Details `RemoveFolderEx` deletes an entire directory tree during installation or uninstallation. It does so by recursing every subdirectory starting at a specified directory and adding each subdirectory to the list of directories Windows Installer should delete. If the setup author instructed `RemoveFolderEx` to delete a per-user folder from a per-machine installer, an attacker could create a directory junction in that per-user folder pointing to a per-machine, protected directory. Windows Installer, when executing the per-machine installer after approval by an administrator, would delete the target of the directory junction.

Advisory Timeline

  • First published March 25, 2024 (931 days ago).
  • Last revised September 10, 2026 — 898 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

NuGet
Update wix to 3.14.1 or later
dotnet add package wix --version 3.14.1
NuGet
Update WixToolset.Util.wixext to 4.0.5 or later
dotnet add package WixToolset.Util.wixext --version 4.0.5
NuGet
Update wix to 4.0.5 or later
dotnet add package wix --version 4.0.5

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (3)

Affects 1 ecosystem: nuget (2).

PackageEcosystemAffectedFixed In
wix
nuget
3.10.0, 3.10.0.1719-pre, 3.10.0.1726-pre, 3.10.0.2103-pre (+24 more)3.14.1
WixToolset.Util.wixext
nuget
4.0.0, 4.0.1, 4.0.2, 4.0.3 (+1 more)4.0.5
wix
nuget
4.0.0, 4.0.0.2926-pre, 4.0.0.3226-pre, 4.0.0.3922-pre (+6 more)4.0.5

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 7.9 score means for each attack dimension.

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
None
Integrity
High
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H

References

Frequently Asked Questions

What is CVE-2024-29188?
Malicious directory junction can cause WiX RemoveFoldersEx to possibly delete elevated files This vulnerability has been assigned a severity rating of HIGH (CVSS score: 7.9/10).
How do I check if my project is affected by CVE-2024-29188?
CVE-2024-29188 affects wix and WixToolset.Util.wixext. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2024-29188 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
7.9

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-jx4p-m4wm-vvjg

Related CVEs

  • CVE-2024-24810
    HIGH

    WiX Toolset's .be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges

  • CVE-2026-106112
    HIGH

    ImageSharp: ICC LUT16 output channel count can write beyond Vector4

  • CVE-2026-106115
    HIGH

    ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer

  • CVE-2024-29187
    HIGH

    WiX based installers are vulnerable to binary hijack when run as SYSTEM

More NuGet advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies