PT-2025-33841 · Allsky · Allsky

Published 2025-08-19 · Updated 2025-12-03 · CVE-2024-44373

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: AllSky version 2023.05.01 04

Description: A path traversal flaw exists in AllSky version 2023.05.01 04 that allows an unauthenticated attacker to create a webshell and achieve remote code execution. The issue is located in the /includes/save file.php endpoint, specifically through manipulation of the path and content parameters.

Recommendations: As a temporary workaround, restrict access to the /includes/save file.php endpoint. Avoid using the path and content parameters in the /includes/save file.php endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-44373

Affected Products

Allsky

References · 10

• https://osv.dev/vulnerability/CVE-2024-44373 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-44373 · Security Note
• https://github.com/AllskyTeam/allsky · Note
• https://github.com/AllskyTeam/allsky/blob/master/html/includes/save_file.php · Note
• https://lean-strand-cb6.notion.site/CVE-2024-44373-21efbd400a6c80f4a5abf5d5eb9b068c · Note
• https://t.me/CVEtracker/30379 · Telegram Post
• https://t.me/cveNotify/144633 · Telegram Post
• https://gh0stmezh.wordpress.com/2024/08/25/cve-2024-44373 · Note
• https://twitter.com/CVEnew/status/1957877395731407140 · Twitter Post
• https://twitter.com/cracbot/status/1959571453751472289 · Twitter Post