Vulnerability · Published Jan 28, 2026 · Assigned by GitHub_M

CVE-2026-24897Authenticated Remote Code Execution via Arbitrary File Upload

Critical 10.0

In plain English

A critical-severity path traversal in Erugo from ErugoOSS. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 3.3% (higher than 88% of all known vulnerabilities).

Severity (CVSS 3.1)10.0Critical

Exploit odds (30 days)3.3%top 11.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Erugo is a self-hosted file-sharing platform. In versions up to and including 0.2.14, an authenticated low-privileged user can upload arbitrary files to any specified location due to insufficient validation of user‑supplied paths when creating shares. By specifying a writable path within the public web root, an attacker can upload and execute arbitrary code on the server, resulting in remote code execution (RCE). This vulnerability allows a low-privileged user to fully compromise the affected Erugo instance. Version 0.2.15 fixes the issue.

Affected products (as reported)

Vendor	Product	Versions
ErugoOSS	Erugo	< 0.2.15

Weakness: CWE-22, CWE-94, CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

https://github.com/ErugoOSS/Erugo/security/advisories/GHSA-336w-hgpq-6369 x_refsource_CONFIRM
https://github.com/ErugoOSS/Erugo/commit/256bc63831a0b5e9a94cb024a0724e0cd5fa5e38 x_refsource_MISC
https://github.com/ErugoOSS/Erugo/releases/tag/v0.2.15 x_refsource_MISC