{"id":"CVE-2026-24897","aliases":["EUVD-2026-4975","GHSA-336w-hgpq-6369"],"status":"published","title":"Authenticated Remote Code Execution via Arbitrary File Upload","description":"Erugo is a self-hosted file-sharing platform. In versions up to and including 0.2.14, an authenticated low-privileged user can upload arbitrary files to any specified location due to insufficient validation of user‑supplied paths when creating shares.\nBy specifying a writable path within the public web root, an attacker can upload and execute arbitrary code on the server, resulting in remote code execution (RCE). This vulnerability allows a low-privileged user to fully compromise the affected Erugo instance. Version 0.2.15 fixes the issue.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.03267,"percentile":0.88497,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-22","CWE-434","CWE-94"],"published":"2026-01-28T22:24:49Z","modified":"2026-10-28T02:31:11Z","exploits":[{"source":"exploitdb","id":"EDB-52529","title":"Erugo  0.2.14 - Remote Code Execution (RCE)","type":"webapps","platform":"multiple","date":"2026-04-30","url":"https://www.exploit-db.com/exploits/52529"}],"products":[{"vendor":"erugo","product":"erugo"},{"vendor":"erugooss","product":"erugo"}],"references":[{"url":"https://github.com/ErugoOSS/Erugo/security/advisories/GHSA-336w-hgpq-6369","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","advisory"]},{"url":"https://github.com/ErugoOSS/Erugo/commit/256bc63831a0b5e9a94cb024a0724e0cd5fa5e38","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://github.com/ErugoOSS/Erugo/releases/tag/v0.2.15","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24897.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24897","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-24897","title":"Authenticated Remote Code Execution via Arbitrary File Upload","description":"Erugo is a self-hosted file-sharing platform. In versions up to and including 0.2.14, an authenticated low-privileged user can upload arbitrary files to any specified location due to insufficient validation of user‑supplied paths when creating shares.\nBy specifying a writable path within the public web root, an attacker can upload and execute arbitrary code on the server, resulting in remote code execution (RCE). This vulnerability allows a low-privileged user to fully compromise the affected Erugo instance. Version 0.2.15 fixes the issue.","status":"published","published":"2026-01-28T22:24:49.915Z","modified":"2026-01-29T16:54:12.343Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-22","CWE-94","CWE-434"],"updated_at":"2026-11-02T14:19:50.24628Z"}],"euvd":[{"id":"EUVD-2026-4975","description":"Erugo is a self-hosted file-sharing platform. In versions up to and including 0.2.14, an authenticated low-privileged user can upload arbitrary files to any specified location due to insufficient validation of user‑supplied paths when creating shares.\nBy specifying a writable path within the public web root, an attacker can upload and execute arbitrary code on the server, resulting in remote code execution (RCE). This vulnerability allows a low-privileged user to fully compromise the affected Erugo instance. Version 0.2.15 fixes the issue.","status":"published","published":"2026-01-28T22:24:49Z","modified":"2026-01-29T16:54:12Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:48:45.944715Z"}],"nvd":[{"id":"CVE-2026-24897","description":"Erugo is a self-hosted file-sharing platform. In versions up to and including 0.2.14, an authenticated low-privileged user can upload arbitrary files to any specified location due to insufficient validation of user‑supplied paths when creating shares.\nBy specifying a writable path within the public web root, an attacker can upload and execute arbitrary code on the server, resulting in remote code execution (RCE). This vulnerability allows a low-privileged user to fully compromise the affected Erugo instance. Version 0.2.15 fixes the issue.","status":"published","published":"2026-01-28T23:15:51.27Z","modified":"2026-06-17T10:23:46.22Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-22","CWE-94","CWE-434"],"updated_at":"2026-11-02T14:12:04.769088Z"}],"osv":[{"id":"CVE-2026-24897","title":"Authenticated Remote Code Execution via Arbitrary File Upload","description":"Erugo is a self-hosted file-sharing platform. In versions up to and including 0.2.14, an authenticated low-privileged user can upload arbitrary files to any specified location due to insufficient validation of user‑supplied paths when creating shares.\nBy specifying a writable path within the public web root, an attacker can upload and execute arbitrary code on the server, resulting in remote code execution (RCE). This vulnerability allows a low-privileged user to fully compromise the affected Erugo instance. Version 0.2.15 fixes the issue.","status":"published","published":"2026-01-28T22:24:49.915Z","modified":"2026-10-28T02:31:11.306080868Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-22","CWE-434","CWE-94"],"updated_at":"2026-11-02T15:44:59.438965Z"}]}}