high6.8
CVE-2024-40400
Automad arbitrary file upload vulnerability
Impact
An arbitrary file upload vulnerability in the image upload function of Automad v2.0.0 allows attackers to execute arbitrary code via a crafted file. The malicious file has to be prepared and uploaded manually by the admin. Usually there is only one admin per site and that is the owner.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | automad/automad | < 2.0.0-alpha.5 | 2.0.0-alpha.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Automad | Automad | through 1.10.9 Version 2.0.0 |