CVE-2024-25626

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Yocto Project is an open source collaboration project that helps developers create custom Linux-based systems regardless of the hardware architecture. In Yocto Projects Bitbake before 2.6.2 (before and included Yocto Project 4.3.1), with the Toaster server (included in bitbake) running, missing input validation allows an attacker to perform a remote code execution in the server's shell via a crafted HTTP request. Authentication is not necessary. Toaster server execution has to be specifically run and is not the default for Bitbake command line builds, it is only used for the Toaster web based user interface to Bitbake. The fix has been backported to the bitbake included with Yocto Project 5.0, 3.1.31, 4.0.16, and 4.3.2.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Feb 19, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-256274.8Alf.io is a free and open source event attendance management system. An administrator on the alf.io application is able to upload HTML files CVE-2024-256287.6Alf.io is a free and open source event attendance management system. In versions prior to 2.0-M4-2402 users can access the admin area even a CVE-2024-256295.5c-ares is a C library for asynchronous DNS requests. `ares__read_line()` is used to parse local configuration files such as `/etc/resolv.con CVE-2024-25639.8A vulnerability has been found in PandaXGO PandaX up to 20240310 and classified as critical. This vulnerability affects the function DeleteI CVE-2024-256305.3Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who are using CRDs to store Cili CVE-2024-256315.3Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who have enabled an external kvs CVE-2024-256328.8eLabFTW is an open source electronic lab notebook for research labs. In the context of eLabFTW, an administrator is a user account with cert CVE-2024-256335.4eLabFTW is an open source electronic lab notebook for research labs. In an eLabFTW system, one can configure who is allowed to create new us CVE-2024-256346.5alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, an attacker can access data from other organizers. The att CVE-2024-256358.8alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, organization owners can view the generated API KEY and USE CVE-2024-256368.8Misskey is an open source, decentralized social media platform with ActivityPub support. Prior to version 2024.2.0, when fetching remote Act CVE-2024-256375.4October is a self-hosted CMS platform based on the Laravel PHP Framework. The X-October-Request-Handler Header does not sanitize the AJAX ha