CVE-2024-58282 Serendipity 2.5.0 Remote Code Execution via Authenticated Media Upload
Authenticated administrators can upload malicious PHP files to execute arbitrary system commands on the web server.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-58282?
CVE-2024-58282 is a high-severity vulnerability in S9y Serendipity, published on 10 Dec 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Serendipity 2.5.0 contains a remote code execution vulnerability that allows authenticated administrators to upload malicious PHP files through the media upload functionality. Attackers can exploit the file upload mechanism by creating a PHP shell with a command execution form that enables arbitrary system command execution on the web server.
Weakness: CWE-434
Which versions are affected by CVE-2024-58282?
It affects 1 product.
Products include S9y Serendipity.
How do I fix CVE-2024-58282?
No fix has been published for CVE-2024-58282 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-58282 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-58282 exists.
Other vulnerabilities in S9y Serendipity
Sources
Also known as GHSA-4x4h-4pgq-3r66.