VULNERABILITY INTELLIGENCE

CVE-2024-11311

CVSS score9.8 CRITICAL
EPSS probability1.39%
CISA KEVNot currently listed
Published2024-11-18
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to upload arbitrary files to any directory, leading to arbitrary code execution by uploading webshells.

Weakness classification

  • twcert@cert.org.tw: CWE-23
  • nvd@nist.gov: CWE-22

Primary references