CVE-2024-7770 File upload in File Manager

What is CVE-2024-7770?

CVE-2024-7770 is a high-severity vulnerability in bitpressadmin File Manager, published on 10 Sep 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload' function in all versions up to, and including, 6.5.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted upload permissions by an administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible.

Weakness: CWE-434

Which versions are affected by CVE-2024-7770?

It affects 1 product.

Products include Bitapps File Manager.

How do I fix CVE-2024-7770?

No fix has been published for CVE-2024-7770 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-7770 being exploited?

There is no known exploitation of CVE-2024-7770 in the wild and no public exploit code.

Other vulnerabilities in bitpressadmin File Manager

• CVE-2024-7627 Bit File Manager 6.0 - 6.5.5 - Unauthenticated Remote Code Execution via Race Condition High 8.1
• CVE-2023-5907 File Manager < 6.3 - Admin+ Arbitrary OS File/Folder Access + Path Traversal Medium 6.5
• CVE-2022-47599 WordPress File Manager Plugin <= 5.2.7 is vulnerable to PHP Object Injection Medium 5.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-r9w3-4w3v-h5x6.