PT-2026-5235 · Erugo · Erugo

Leon-Aware7 · Publicado 2026-01-28 · Atualizado 2026-02-09 · CVE-2026-24897

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Erugo versions up to and including 0.2.14

Description Erugo is a self-hosted file-sharing platform. An authenticated, low-privileged user can upload arbitrary files to any specified location due to insufficient validation of user-supplied paths when creating shares. By specifying a writable path within the public web root, an attacker can upload and execute arbitrary code on the server, resulting in remote code execution (RCE). This allows a low-privileged user to fully compromise the affected Erugo instance. The vulnerability is triggered through insufficient validation of paths used when creating shares. The vulnerable component allows attackers to upload files to arbitrary locations, potentially leading to the execution of malicious code.

Recommendations Versions prior to 0.2.15 are affected. Update to version 0.2.15 to address the vulnerability.

Exploit

Correção

RCE

Path traversal

Code Injection

Unrestricted File Upload

Enumeração de Fraquezas

CWE-22

CWE-94

CWE-434

Identificadores relacionados

BDU:2026-05160

CVE-2026-24897

GHSA-336W-HGPQ-6369

Produtos afetados

Erugo

Referências · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24897.json · Exploit
• 🔥 https://github.com/ErugoOSS/Erugo/security/advisories/GHSA-336w-hgpq-6369 · Exploit
• https://github.com/ErugoOSS/Erugo/releases/tag/v0.2.15 · Nota
• https://github.com/ErugoOSS/Erugo/commit/256bc63831a0b5e9a94cb024a0724e0cd5fa5e38 · Correção
• https://twitter.com/CVEnew/status/2016646183264063711 · Publicação no Twitter
• https://twitter.com/pulsepatchio/status/2016885482899001634 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2016755426440683688 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2016662008142450851 · Publicação no Twitter
• https://t.me/cveNotify/151419 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-24897 · Nota de Segurança
• https://t.me/CVEtracker/43210 · Publicação no Telegram
• https://twitter.com/CveFindCom/status/2016665404215595125 · Publicação no Twitter
• https://t.me/cveNotify/150218 · Publicação no Telegram
• https://twitter.com/0dayPublishing/status/2016642777761685786 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-24897 · Aviso do Fabricante