Arbitrary File Upload Vulnerability in ThingsBoard Products
CVE-2024-55466

6.5MEDIUM

Key Information:

Vendor: ThingsBoard
Status: ThingsBoard Community and ThingsBoard Cloud
Vendor: CVE Published:; 12 May 2025

🔔 Create ThingsBoard Vulnerability Alert

What is CVE-2024-55466?

An arbitrary file upload vulnerability exists in the Image Gallery feature of ThingsBoard Community and Cloud versions 3.8.1. This flaw allows attackers to upload malicious files, potentially leading to the execution of arbitrary code on the server. The vulnerability poses significant security risks, enabling unauthorized access and control over affected systems. Immediate action is recommended to mitigate exploitation risks.

References

https://github.com/thingsboard/thingsboard/releases/tag/v...

https://github.com/cybsecsid/ThingsBoard-IoT-Platform-CVE...

CVSS V3.1

Score:

6.5

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
May 12, 2025
Vulnerability Reserved
Dec 6, 2024

CVE-2024-55466 Data

JSON