{"id":"CVE-2024-29399","aliases":["EUVD-2024-26406","GHSA-rhmf-g96x-3g22"],"status":"published","title":"An issue was discovered in GNU Savane v.3.13 and before, allows a remote attacker to execute...","description":"An issue was discovered in GNU Savane v.3.13 and before, allows a remote attacker to execute arbitrary code and escalate privileges via a crafted file to the upload.php component.","severity":{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00948,"percentile":0.61651,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-94"],"published":"2024-04-11T00:00:00Z","modified":"2026-06-17T07:22:47Z","exploits":[{"source":"pocgithub","id":"ally-petitt/CVE-2024-29399","title":"ally-petitt/CVE-2024-29399","date":"2024-04-08","url":"https://github.com/ally-petitt/CVE-2024-29399"}],"products":[{"vendor":"gnu","product":"savane"}],"references":[{"url":"https://github.com/ally-petitt/CVE-2024-29399","tags":["x_transferred","Exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-29399"},{"url":"https://github.com/advisories/GHSA-rhmf-g96x-3g22"}],"sources":{"cve":[{"id":"CVE-2024-29399","description":"An issue was discovered in GNU Savane v.3.13 and before, allows a remote attacker to execute arbitrary code and escalate privileges via a crafted file to the upload.php component.","status":"published","published":"2024-04-11T00:00:00Z","modified":"2024-08-28T17:58:19.558Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"adp"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:34:15.337999Z"}],"euvd":[{"id":"EUVD-2024-26406","description":"An issue was discovered in GNU Savane v.3.13 and before, allows a remote attacker to execute arbitrary code and escalate privileges via a crafted file to the upload.php component.","status":"published","published":"2024-04-11T00:00:00Z","modified":"2024-08-28T17:58:19Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-03T00:56:08.84137Z"}],"ghsa":[{"id":"GHSA-rhmf-g96x-3g22","title":"An issue was discovered in GNU Savane v.3.13 and before, allows a remote attacker to execute...","description":"An issue was discovered in GNU Savane v.3.13 and before, allows a remote attacker to execute arbitrary code and escalate privileges via a crafted file to the upload.php component.","status":"published","published":"2024-04-11T06:30:35Z","modified":"2024-08-28T21:32:34Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:58:07.628234Z"}],"nvd":[{"id":"CVE-2024-29399","description":"An issue was discovered in GNU Savane v.3.13 and before, allows a remote attacker to execute arbitrary code and escalate privileges via a crafted file to the upload.php component.","status":"published","published":"2024-04-11T06:15:06.903Z","modified":"2026-06-17T07:22:47.47Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:09:50.299382Z"}]}}