CVE-2025-24372

Summary

CVE-2025-24372 is a vulnerability affecting CKAN, an open-source Data Management System. A malicious user, who must be registered on the site, could upload a file containing code that, if opened by an administrator, could result in privilege escalation or other malicious actions. The issue arises due to insufficient file type validation. CKAN versions prior to 2.10.7 and 2.11.2 are vulnerable. To mitigate this risk, users are strongly advised to upgrade to the patched versions. Alternatively, site maintainers can restrict file types using config options, or completely disable file uploads.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.