CVE-2026-24729

Critical

Published: 30/01/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

Unrestricted upload of file with dangerous type vulnerability in the file upload function of Interinfo DreamMaker versions before 2025/10/22. Remote attackers can execute arbitrary system commands via a malicious class file.

Risk Assessment

An attacker can achieve remote code execution on the server, potentially leading to full system compromise and data confidentiality breach.

Recommendation

It is recommended to immediately update Interinfo DreamMaker to version 2025/10/22 or later. Also, restrict file upload capabilities to trusted users only.

Original NVD description (English source)

An unrestricted upload of file with dangerous type vulnerability in the file upload function of Interinfo DreamMaker versions before 2025/10/22 allows remote attackers to execute arbitrary system commands via a malicious class file.