CVE-2024-56828
CVSS 3.1 Score 9.8 of 10 (high)
Details
Published Jan 6, 2025
Updated: Jan 14, 2025
CWE ID 434
Summary
CVE-2024-56828 is a file upload vulnerability affecting ChestnutCMS versions up to 1.5.0. The vulnerability lies in the /api/member/avatar API endpoint, which receives a base64-encoded image as input. Upon receiving this input, the base64 string is parsed and decoded, with the file extension extracted from the string and used to write the decoded content to a file. However, the validation of the file extension is lacking, making it possible for an attacker to upload files with malicious code, posing a significant security risk.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.