{"id":"CVE-2024-0864","aliases":["EUVD-2024-16647","GHSA-4g4j-672p-6638"],"status":"published","title":"RCE in Laragon","description":"Enabling Simple Ajax Uploader plugin included in Laragon open-source software allows for a remote code execution (RCE) attack via an improper input validation in a file_upload.php file which serves as an example.\nBy default, Laragon is not vulnerable until a user decides to use the aforementioned plugin.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.01366,"percentile":0.72242,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-20","CWE-434"],"published":"2024-02-29T12:56:23Z","modified":"2026-10-28T02:30:23Z","products":[{"vendor":"laragon","product":"laragon"},{"vendor":"leo khoa","product":"laragon"},{"vendor":"leokhoa","product":"laragon"}],"references":[{"url":"https://laragon.org/","tags":["product","x_transferred","Product","web"]},{"url":"https://cert.pl/en/posts/2024/02/CVE-2024-0864","tags":["third-party-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://cert.pl/posts/2024/02/CVE-2024-0864","tags":["third-party-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-0864","tags":["advisory"]},{"url":"https://laragon.org"},{"url":"https://github.com/advisories/GHSA-4g4j-672p-6638"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/0xxx/CVE-2024-0864.json","tags":["advisory"]},{"url":"https://github.com/leokhoa/laragon","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-0864","title":"RCE in Laragon","description":"Enabling Simple Ajax Uploader plugin included in Laragon open-source software allows for a remote code execution (RCE) attack via an improper input validation in a file_upload.php file which serves as an example.\nBy default, Laragon is not vulnerable until a user decides to use the aforementioned plugin.","status":"published","published":"2024-02-29T12:56:23.545Z","modified":"2024-10-10T15:36:13.513Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:34:22.525279Z"}],"euvd":[{"id":"EUVD-2024-16647","description":"Enabling Simple Ajax Uploader plugin included in Laragon open-source software allows for a remote code execution (RCE) attack via an improper input validation in a file_upload.php file which serves as an example.\nBy default, Laragon is not vulnerable until a user decides to use the aforementioned plugin.","status":"published","published":"2024-02-29T12:56:23Z","modified":"2024-10-10T15:36:13Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:27:41.012246Z"}],"ghsa":[{"id":"GHSA-4g4j-672p-6638","title":"Enabling Simple Ajax Uploader plugin included in Laragon open-source software allows for a remote...","description":"Enabling Simple Ajax Uploader plugin included in Laragon open-source software allows for a remote code execution (RCE) attack via an improper input validation in a file_upload.php file which serves as an example.\nBy default, Laragon is not vulnerable until a user decides to use the aforementioned plugin.","status":"published","published":"2024-02-29T15:32:26Z","modified":"2026-03-21T05:18:37Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20","CWE-434"],"updated_at":"2026-11-02T15:06:44.698439Z"}],"nvd":[{"id":"CVE-2024-0864","description":"Enabling Simple Ajax Uploader plugin included in Laragon open-source software allows for a remote code execution (RCE) attack via an improper input validation in a file_upload.php file which serves as an example.\nBy default, Laragon is not vulnerable until a user decides to use the aforementioned plugin.","status":"published","published":"2024-02-29T13:15:07.26Z","modified":"2026-06-17T06:54:27.483Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:09:38.473056Z"}],"osv":[{"id":"CVE-2024-0864","title":"RCE in Laragon","description":"Enabling Simple Ajax Uploader plugin included in Laragon open-source software allows for a remote code execution (RCE) attack via an improper input validation in a file_upload.php file which serves as an example.\nBy default, Laragon is not vulnerable until a user decides to use the aforementioned plugin.","status":"published","published":"2024-02-29T12:56:23.545Z","modified":"2026-10-28T02:30:23.198908482Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T15:44:37.180532Z"}]}}