CVE-2024-21546

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Versions of the package unisharp/laravel-filemanager before 2.9.1 are vulnerable to Remote Code Execution (RCE) through using a valid mimetype and inserting the . character after the php file extension. This allows the attacker to execute malicious code.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Dec 18, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-215477.5Versions of the package spatie/browsershot before 5.0.2 are vulnerable to Directory Traversal due to URI normalisation in the browser where CVE-2024-215487.5Versions of the package bun after 0.0.12 and before 1.1.30 are vulnerable to Prototype Pollution due to improper input sanitization. An atta CVE-2024-215498.6Versions of the package spatie/browsershot before 5.0.3 are vulnerable to Improper Input Validation due to improper URL validation in the se CVE-2024-21554.3A vulnerability was found in SourceCodester Best POS Management System 1.0 and classified as problematic. This issue affects some unknown pr CVE-2024-215506.1SteVe is an open platform that implements different version of the OCPP protocol for Electric Vehicle charge points, acting as a central ser CVE-2024-215529.8All versions of `SuperAGI` are vulnerable to Arbitrary Code Execution due to unsafe use of the ‘eval’ function. An attacker could induce the CVE-2024-21569.8A vulnerability was found in SourceCodester Best POS Management System 1.0. It has been classified as critical. Affected is an unknown funct CVE-2024-215718.1Snyk has identified a remote code execution (RCE) vulnerability in all versions of Code Agent. The vulnerability enables an attacker to exec CVE-2024-2157410.0The issue stems from a missing validation of the pip field in a POST request sent to the /customnode/install endpoint used to install custom CVE-2024-215758.6ComfyUI-Impact-Pack is vulnerable to Path Traversal. The issue stems from missing validation of the `image.filename` field in a POST request CVE-2024-2157610.0ComfyUI-Bmad-Nodes is vulnerable to Code Injection. The issue stems from a validation bypass in the BuildColorRangeHSVAdvanced, FilterContou CVE-2024-2157710.0ComfyUI-Ace-Nodes is vulnerable to Code Injection. The ACE_ExpressionEval node contains an eval() in its entrypoint function that accepts ar