CVE-2024-58281

Dotclear 2.29 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the media upload functionality. Attackers can exploit the file upload process by crafting a PHP shell with a command execution form to gain system access through the uploaded file.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.dotclear.org/explore/repos	Broken Link
https://github.com/dotclear/dotclear/archive/refs/heads/master.zip	Product
https://www.exploit-db.com/exploits/52037	Exploit Third Party Advisory
https://www.vulncheck.com/advisories/dotclear-remote-code-execution-via-authenticated-file-upload	Third Party Advisory
https://github.com/dotclear/dotclear/archive/refs/heads/master.zip	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:dotclear:dotclear:2.29:*:*:*:*:*:*:*

History

26 Sep 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Dotclear 2.29 contiene una vulnerabilidad de ejecución remota de código que permite a atacantes autenticados subir archivos PHP maliciosos a través de la funcionalidad de carga de medios. Los atacantes pueden explotar el proceso de carga de archivos creando un shell PHP con un formulario de ejecución de comandos para obtener acceso al sistema a través del archivo subido.

Information

Published : 2025-12-10 22:16

Updated : 2026-09-26 21:10

NVD link : CVE-2024-58281

Mitre link : CVE-2024-58281

CVE.ORG link : CVE-2024-58281

JSON object : View

Products Affected

dotclear

dotclear

CWE

CWE-434

Unrestricted Upload of File with Dangerous Type

{"id": "CVE-2024-58281", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-58281", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-12-11T15:48:16.394000Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "dotclear", "product": "Dotclear", "versions": [{"status": "affected", "version": "2.29"}], "defaultStatus": "unaffected"}]}], "published": "2025-12-10T22:16:19.907", "references": [{"url": "https://git.dotclear.org/explore/repos", "tags": ["Broken Link"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/dotclear/dotclear/archive/refs/heads/master.zip", "tags": ["Product"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.exploit-db.com/exploits/52037", "tags": ["Exploit", "Third Party Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/dotclear-remote-code-execution-via-authenticated-file-upload", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/dotclear/dotclear/archive/refs/heads/master.zip", "tags": ["Product"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "Dotclear 2.29 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the media upload functionality. Attackers can exploit the file upload process by crafting a PHP shell with a command execution form to gain system access through the uploaded file."}, {"lang": "es", "value": "Dotclear 2.29 contiene una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo que permite a atacantes autenticados subir archivos PHP maliciosos a trav\u00e9s de la funcionalidad de carga de medios. Los atacantes pueden explotar el proceso de carga de archivos creando un shell PHP con un formulario de ejecuci\u00f3n de comandos para obtener acceso al sistema a trav\u00e9s del archivo subido."}], "lastModified": "2026-09-26T21:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dotclear:dotclear:2.29:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E604EAF6-9764-4ECC-8F3B-B981F9D07420"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}