Attackers Can Execute Arbitrary Code on Linux Devices via Valid PNG Files

CVE-2024-47946

What is CVE-2024-47946?

A vulnerability in Image Access software allows an attacker with a valid Poweruser session to execute arbitrary PHP code and operating system commands. By uploading specially crafted PNG files containing injected PHP scripts as desktop backgrounds or lock screens, the attacker can access this code via the web root once the file is accessed. This flaw poses significant security risks as the executed code runs with the privileges of the web server user, leading to potential compromise of the affected system.

References