CVE-2026-24897

Katalog CVE

CVSS 8.8 · High EPSS 3,3%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada erugo. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Erugo is a self-hosted file-sharing platform. In versions up to and including 0.2.14, an authenticated low-privileged user can upload arbitrary files to any specified location due to insufficient validation of user‑supplied paths when creating shares. By specifying a writable path within the public web root, an attacker can upload and execute arbitrary code on the server, resulting in remote code execution (RCE). This vulnerability allows a low-privileged user to fully compromise the affected Erugo instance. Version 0.2.15 fixes the issue.

Rincian

Terbit di NVD

28 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-434: Unrestricted Upload of File with Dangerous Type

EPSS (30 hari)

3,3% peluang dieksploitasi; lebih tinggi dari 88,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ErugoOSS/Erugo/security/advisories/GHSA-336w-hgpq-6369 exploit · advisory vendor
• https://github.com/ErugoOSS/Erugo/commit/256bc63831a0b5e9a94cb024a0724e0cd5fa5e38 patch
• https://github.com/ErugoOSS/Erugo/releases/tag/v0.2.15 release notes