Malicious directory junction can cause WiX RemoveFoldersEx to possibly delete elevated files
Summary
The custom action behind WiX's RemoveFolderEx functionality could allow a standard user to delete protected directories.
Details
RemoveFolderEx deletes an entire directory tree during installation or uninstallation. It does so by recursing every subdirectory starting at a specified directory and adding each subdirectory to the list of directories Windows Installer should delete. If the setup author instructed RemoveFolderEx to delete a per-user folder from a per-machine installer, an attacker could create a directory junction in that per-user folder pointing to a per-machine, protected directory. Windows Installer, when executing the per-machine installer after approval by an administrator, would delete the target of the directory junction.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| .NET (NuGet) | wix | < 3.14.1, >= 4.0.0, < 4.0.5 | 3.14.1, 4.0.5 |
| .NET (NuGet) | WixToolset.Util.wixext | < 4.0.5 | 4.0.5 |
References
- https://github.com/wixtoolset/issues/security/advisories/GHSA-jx4p-m4wm-vvjg
- https://nvd.nist.gov/vuln/detail/CVE-2024-29188
- https://github.com/wixtoolset/wix/commit/2e5960b575881567a8807e6b8b9c513138b19742
- https://github.com/wixtoolset/wix3/commit/93eeb5f6835776694021f66d4226c262c67d487a
- https://github.com/wixtoolset/issues
- CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H- Weakness (CWE)
CWE-59- Platform
- .NET (NuGet)
- Package
wix, WixToolset.Util.wixext- Disclosed
- 25.03.2024
- Updated
- 11.10.2026 11:23
Sources and licenses
OSV / GitHub Advisory Database - GHSA-jx4p-m4wm-vvjg - CC BY 4.0
Vulnerability history: WixToolset.Util.wixext
All published vulnerabilities of this package (.NET (NuGet)), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.