CVE-2024-58282 HIGH

CVE-2024-58282: Serendipity 2.5.0 Remote Code Execution via Authenticated Media Upload

Vendor Serendipity

Product Serendipity

Weakness CWE-434 · Unrestricted file upload

Published December 10, 2025

Last update April 7, 2026

View on NVD All CVEs

CVSS base score

8.6/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Serendipity 2.5.0 contains a remote code execution vulnerability that allows authenticated administrators to upload malicious PHP files through the media upload functionality. Attackers can exploit the file upload mechanism by creating a PHP shell with a command execution form that enables arbitrary system command execution on the web server.

Key dates

02Disclosure timeline

December 10, 2025 CVE published

April 7, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-58282 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/434.html

Related vulnerabilities

04Related CVE

CVE-2025-62182 Pega Customer Service Framework versions 8.7.0 through 25.1.0 are affected by a Unrestricted file upload vulnerability, where a privileged user could potentially upload a malicious file. CVE-2025-10616 itsourcecode E-Commerce Website users.php unrestricted upload CVE-2023-3032 Mobatime web application - Arbitrary file upload (RCE) CVE-2023-25444 WordPress JS Help Desk – Best Help Desk & Support Plugin plugin <= 2.7.7 - Arbitrary File Upload vulnerability CVE-2025-11508 code-projects Voting System voters_add.php unrestricted upload