CVE-2024-0864

Published: Feb 29, 2024Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Enabling Simple Ajax Uploader plugin included in Laragon open-source software allows for a remote code execution (RCE) attack via an improper input validation in a file_upload.php file which serves as an example. By default, Laragon is not vulnerable until a user decides to use the aforementioned plugin.

Affected (1)

Products: Laragon: Laragon

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Laragon Laragon	Before 7.0.0

Related CWEs

Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (6)

https://cert.pl/en/posts/2024/02/CVE-2024-0864

Source: cvd@cert.pl

Third Party Advisory

https://cert.pl/posts/2024/02/CVE-2024-0864

Source: cvd@cert.pl

Third Party Advisory

https://laragon.org/

Source: cvd@cert.pl

Product

https://cert.pl/en/posts/2024/02/CVE-2024-0864

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://cert.pl/posts/2024/02/CVE-2024-0864

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://laragon.org/

Source: af854a3a-2127-422b-91ae-364da2661108

Product

Timeline

No history available yet.