CVE-2024-39171

A directory traversal vulnerability was found in PHPVibe v11.0.46 due to incomplete blacklist checksums and directory checks. This allows an attacker to execute code by writing specific directives to .htaccess and code to a file with a .png extension.

The risk for the organization is the possibility of remote code execution by an attacker, which could lead to server compromise, data theft, or further propagation of the attack within the infrastructure.

Immediately update PHPVibe to the latest available version that fixes this vulnerability. If an update is not possible, implement temporary mitigations such as restricting access to .htaccess files and validating file paths.