CVE-2024-40400 Automad arbitrary file upload vulnerability
Attackers can execute arbitrary code by uploading a crafted file via the image upload function in Automad.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-40400?
CVE-2024-40400 is a high-severity vulnerability in n/a, published on 19 Jul 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An arbitrary file upload vulnerability in the image upload function of Automad v2.0.0 allows attackers to execute arbitrary code via a crafted file.
Weakness: CWE-434
Which versions are affected by CVE-2024-40400?
2 open source packages ship an affected version, including automad/automad. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
automad/automad Packagist | All versions | 2.0.0-alpha.5 |
automad/automad Packagist | All versions | 2.0.0-alpha.5 |
Products include Automad Automad.
How do I fix CVE-2024-40400?
Upgrade automad/automad to 2.0.0-alpha.5 or later.
Is CVE-2024-40400 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-40400 exists.
Other vulnerabilities in n/a
- CVE-2023-7037 automad FileController.php import server-side request forgery
- CVE-2021-37502 Cross site scripting in automad/automad
- CVE-2024-40111 Cross-site scripting in n/a
- CVE-2023-7035 automad Setting post.php cross site scripting
- CVE-2023-7036 automad Content Type FileCollectionController.php upload unrestricted upload
Sources
Also known as GHSA-47mc-qmh2-mqj4.