CVE-2024-33120

CriticalCVSS 9.8

Published: 07/05/2024(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.77%

51th percentile - higher than 51% of all known CVEs

Summary

Roothub v2.5 was discovered to contain an arbitrary file upload vulnerability via the customPath parameter in the upload() function. This allows attackers to execute arbitrary code via a crafted JSP file.

Risk Assessment

An attacker can gain full control of the server by executing malicious code, leading to compromise of data confidentiality, integrity, and availability.

Recommendation

Immediately update Roothub to the latest version and restrict JSP file uploads by validating extensions and paths.

Original NVD description (English source)

Roothub v2.5 was discovered to contain an arbitrary file upload vulnerability via the customPath parameter in the upload() function. This vulnerability allows attackers to execute arbitrary code via a crafted JSP file.