What is CVE-2024-52306?

CVE-2024-52306 is a high-severity vulnerability in Backpackforlaravel Filemanager, classified under Deserialization of Untrusted Data. CVSS score: 7.6/10. Published 2024-11-13.

How severe is CVE-2024-52306?

High severity. CVSS v3 base score is 7.6 out of 10.

Deserialization in Backpackforlaravel Filemanager

CVE-2024-52306

FileManager provides a Backpack admin interface for files and folder. Prior to 3.0.9, deserialization of untrusted data from the mimes parameter could lead to remote code execution. This vulnerability is fixed in 3.0.9.

Vulnerability class: Insecure Deserialization

EPSS: 0.006 (43.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.6 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H.

Affected products

Backpackforlaravel Filemanager
Laravel-backpack Filemanager — versions < 3.0.9

Weakness classification (CWE)

CWE-502 — Deserialization of Untrusted Data

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2024-52306?: CVE-2024-52306 is a high-severity vulnerability in Backpackforlaravel Filemanager, classified under Deserialization of Untrusted Data. CVSS score: 7.6/10. Published 2024-11-13.
How severe is CVE-2024-52306?: High severity. CVSS v3 base score is 7.6 out of 10.