Approved changes feed: RSS · Atom
cpe:2.3:a:erugooss:erugo:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Erugooss (94043619-b7a0-5228-a0c5-4aee6fadd3ad) |
|---|---|
| Product | Erugo (fbf276d7-f7a2-510f-a711-09595d4aa032) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-24897 |
vulnerable | 2026-06-08 07:53:18.648100 |
Authenticated Remote Code Execution via Arbitrary File Upload
CRITICAL (10)
Erugo is a self-hosted file-sharing platform. In versions up to and including 0.2.14, an authenticated low-privileged user can upload arbitrary files to any specified location due to insufficient validation of user‑supplied paths when creating shares.
By specifying a writable path within the public web root, an attacker can upload and execute arbitrary code on the server, resulting in remote code execution (RCE). This vulnerability allows a low-privileged user to fully compromise the affected Erugo instance. Version 0.2.15 fixes the issue.
Published: 2026-01-28T22:24:49.915Z
Updated: 2026-01-29T16:54:12.343Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.