CVE-2024-6848: Wp Base64 Upload Missing Mime Validation
Base64 decoded content is directly uploaded via `wp_upload_bits` without validating its actual MIME type. This allows attackers to upload arbitrary malicious files, which can lead to Stored Cross-Site Scripting (XSS) or Remote Code Execution (RCE) depending on the file extension and server configuration. Validate the decoded content using `finfo_buffer` befo
PHPβgreprules fetch cve-2024-6848-wp-base64-upload-missing-mime-validation --engine opengrepDescription
Base64 decoded content is directly uploaded via `wp_upload_bits` without validating its actual MIME type. This allows attackers to upload arbitrary malicious files, which can lead to Stored Cross-Site Scripting (XSS) or Remote Code Execution (RCE) depending on the file extension and server configuration. Validate the decoded content using `finfo_buffer` befo
Community feedback
0 signals from signed-in users.
- Useful
- 0
- False positive
- 0
- Metadata
- 0