GitHub Advisoryadvisory · Packagist

GHSA-47mc-qmh2-mqj4 Automad arbitrary file upload vulnerability

HIGH Published 2024-07-19 Modified 2024-11-18 Official page ↗
Aliases
CVE-2024-40400
Ecosystem
Packagist
Packages
automad/automad
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-434
Reviewed
2024-07-19

Affected packages

• Packagist automad/automad: < 2.0.0-alpha.5 → fixed in 2.0.0-alpha.5

Description

An arbitrary file upload vulnerability in the image upload function of Automad v2.0.0 allows attackers to execute arbitrary code via a crafted file. The malicious file has to be prepared and uploaded manually by the admin. Usually there is only one admin per site and that is the owner.

Related

Alias · CVE (1)

  • CVE-2024-40400 An arbitrary file upload vulnerability in the image upload function of Automad v2.0.0 allows attackers to execute arbitrary code via a… vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References