Unrestricted File Upload Vulnerability in TRCore's DVC Allows Arbitrary Code Execution

CVE-2024-11314

Summary

The DVC product from TRCore is affected by a Path Traversal vulnerability that permits unauthenticated remote attackers to upload arbitrary files to any directory on the server. This exploitation can lead to significant security concerns, as attackers can potentially upload webshells or malicious scripts, subsequently executing arbitrary code. The lack of restrictions on file types contributes to this vulnerability, making it crucial for users to apply necessary patches or mitigations to secure their systems and protect sensitive data.

References