CVE-2026-24897: Authenticated Remote Code Execution via Arbitrary File Upload
Erugo is a self-hosted file-sharing platform. In versions up to and including 0.2.14, an authenticated low-privileged user can upload arbitrary files to any specified location due to insufficient validation of user‑supplied paths when creating shares. By specifying a writable path within the public web root, an attacker can upload and execute arbitrary code on the server, resulting in remote code execution (RCE). This vulnerability allows a low-privileged user to fully compromise the affected Erugo instance. Version 0.2.15 fixes the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24897?
CVE-2026-24897 has a high severity rating due to the potential for authenticated remote code execution.
How do I fix CVE-2026-24897?
To fix CVE-2026-24897, upgrade Erugo to version 0.2.15 or later where the vulnerability has been addressed.
Who is affected by CVE-2026-24897?
CVE-2026-24897 affects all versions of Erugo up to and including 0.2.14.
What type of vulnerability is CVE-2026-24897?
CVE-2026-24897 is classified as an authenticated remote code execution vulnerability via arbitrary file upload.
What is the impact of CVE-2026-24897 on users?
The impact of CVE-2026-24897 allows low-privileged authenticated users to upload arbitrary files, potentially leading to malicious code execution.