Description
Erugo is a self-hosted file-sharing platform. In versions up to and including 0.2.14, an authenticated low-privileged user can upload arbitrary files to any specified location due to insufficient validation of user‑supplied paths when creating shares. By specifying a writable path within the public web root, an attacker can upload and execute arbitrary code on the server, resulting in remote code execution (RCE). This vulnerability allows a low-privileged user to fully compromise the affected Erugo instance. Version 0.2.15 fixes the issue.
INFO
Published Date :
2026-01-28T22:24:49.915Z
Last Modified :
2026-01-29T16:54:12.343Z
Source :
GitHub_M
AFFECTED PRODUCTS
The following products are affected by CVE-2026-24897 vulnerability.
| Vendors | Products |
|---|---|
| Erugo |
|
| Erugooss |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2026-24897.
