DVC Path Traversal Vulnerability Leads to Arbitrary Code Execution

CVE-2024-11315

Summary

The DVC product from TRCore is identified to have a path traversal vulnerability that permits unauthenticated remote attackers to upload arbitrary files to any directory on the server. This flaw arises from the lack of restrictions on the types of files that can be uploaded, creating an opportunity for attackers to deploy malicious webshells. The vulnerability highlights significant security risks, compromising the integrity and confidentiality of affected systems. Users and administrators are advised to apply the latest security patches to mitigate this risk effectively.

References