CVE-2024-52306

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

FileManager provides a Backpack admin interface for files and folder. Prior to 3.0.9, deserialization of untrusted data from the mimes parameter could lead to remote code execution. This vulnerability is fixed in 3.0.9.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published
Nov 13, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-523075.6authentik is an open-source identity provider. Due to the usage of a non-constant time comparison for the /-/metrics/ endpoint it was possibCVE-2024-523089.6The GitHub CLI version 2.6.1 and earlier are vulnerable to remote code execution through a malicious codespace SSH server when using `gh codCVE-2024-523095.1SFTPGo is a full-featured and highly configurable SFTP, HTTP/S, FTP/S and WebDAV server - S3, Google Cloud Storage, Azure Blob. One powerfulCVE-2024-52316.5A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0 and classified as critical. Affected by this issue isCVE-2024-523116.3Authentication tokens issued via Cognito in data.all are not invalidated on log out, allowing for previously authenticated user to continue CVE-2024-523125.4Due to inconsistent authorization permissions, data.all may allow an external actor with an authenticated account to perform restricted operCVE-2024-523134.3An authenticated data.all user is able to manipulate a getDataset query to fetch additional information regarding the parent Environment resCVE-2024-523144.9A data.all admin team member who has access to the customer-owned AWS Account where data.all is deployed may be able to extract user data frCVE-2024-523169.8Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) SCVE-2024-523176.5Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requesCVE-2024-523186.1Incorrect object recycling and reuse vulnerability in Apache Tomcat. This issue affects Apache Tomcat: 11.0.0, 10.1.31, 9.0.96. Users are CVE-2024-523197.8In the Linux kernel, the following vulnerability has been resolved: mm: use aligned address in clear_gigantic_page() In current kernel, hu