CVE-2024-58279
appRain CMF 4.0.5 Authenticated Remote Code Execution via Filemanager Upload
- State
- Published
- Severity
- 8.6 High
- Published
- Dec 10, 2025
- Updated
- Jul 14, 2026
- Reserved
- Dec 10, 2025
Description
appRain CMF 4.0.5 contains an authenticated remote code execution vulnerability that allows administrative users to upload malicious PHP files through the filemanager upload endpoint. Attackers can leverage authenticated access to generate a web shell with command execution capabilities by uploading a crafted PHP file to the site's uploads directory.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.6 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
Weaknesses
- CWE-434 Unrestricted Upload of File with Dangerous Type
Affected Products
| Product | Versions |
|---|---|
appRain CMFapprain |
|
References
- ExploitDB-52041exploit
- Official Vendor Homepagevendor-advisoryproduct
- Software Linkproduct
- VulnCheck Advisory: appRain CMF 4.0.5 Authenticated Remote Code Execution via Filemanager Uploadthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.