VULNERABILITY INTELLIGENCE

CVE-2024-58279

CVSS score8.6 HIGH
EPSS probability0.95%
CISA KEVNot currently listed
Published2025-12-10
Last modified2026-09-26
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Description

appRain CMF 4.0.5 contains an authenticated remote code execution vulnerability that allows administrative users to upload malicious PHP files through the filemanager upload endpoint. Attackers can leverage authenticated access to generate a web shell with command execution capabilities by uploading a crafted PHP file to the site's uploads directory.

Weakness classification

  • CWE-434: Unrestricted Upload of File with Dangerous Type

Primary references