CVE-2024-29640

CriticalCVSS 9.8

Published: 29/03/2024(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.17%

64th percentile - higher than 64% of all known CVEs

Summary

A vulnerability in aliyundrive-webdav version 2.3.3 and earlier allows a remote attacker to execute arbitrary code via a crafted payload to the sid parameter in the action_query_qrcode component.

Risk Assessment

An attacker can take over the server, leading to compromise of data confidentiality, integrity, and availability, with potential lateral movement within the internal network.

Recommendation

Immediately update aliyundrive-webdav to the latest available version that fixes this vulnerability, and restrict access to the web interface to trusted IP addresses only.

Original NVD description (English source)

An issue in aliyundrive-webdav v.2.3.3 and before allows a remote attacker to execute arbitrary code via a crafted payload to the sid parameter in the action_query_qrcode component.