CVE-2026-24673

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24673", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-23T20:40:23.388Z", "datePublished": "2026-02-03T16:56:59.723Z", "dateUpdated": "2026-02-04T16:52:24.978Z"}, "containers": {"cna": {"title": "Open eClass Has File Upload Filter Bypass via ZIP Archive Extraction", "problemTypes": [{"descriptions": [{"cweId": "CWE-434", "lang": "en", "description": "CWE-434: Unrestricted Upload of File with Dangerous Type", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/gunet/openeclass/security/advisories/GHSA-3g4j-56gp-v6wv", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/gunet/openeclass/security/advisories/GHSA-3g4j-56gp-v6wv"}], "affected": [{"vendor": "gunet", "product": "openeclass", "versions": [{"version": "< 4.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-03T16:56:59.723Z"}, "descriptions": [{"lang": "en", "value": "The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a file upload validation bypass vulnerability allows attackers to upload files with prohibited extensions by embedding them inside ZIP archives and extracting them using the application\u2019s built-in decompression functionality. This issue has been patched in version 4.2."}], "source": {"advisory": "GHSA-3g4j-56gp-v6wv", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-04T15:46:36.435632Z", "id": "CVE-2026-24673", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T16:52:24.978Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24673", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-04T15:46:36.435632Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T15:46:37.367Z"}}], "cna": {"title": "Open eClass Has File Upload Filter Bypass via ZIP Archive Extraction", "source": {"advisory": "GHSA-3g4j-56gp-v6wv", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "gunet", "product": "openeclass", "versions": [{"status": "affected", "version": "< 4.2"}]}], "references": [{"url": "https://github.com/gunet/openeclass/security/advisories/GHSA-3g4j-56gp-v6wv", "name": "https://github.com/gunet/openeclass/security/advisories/GHSA-3g4j-56gp-v6wv", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a file upload validation bypass vulnerability allows attackers to upload files with prohibited extensions by embedding them inside ZIP archives and extracting them using the application\u2019s built-in decompression functionality. This issue has been patched in version 4.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434: Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-03T16:56:59.723Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24673", "state": "PUBLISHED", "dateUpdated": "2026-02-04T16:52:24.978Z", "dateReserved": "2026-01-23T20:40:23.388Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-03T16:56:59.723Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "openeclass", "vendor": "gunet", "versions": [{"status": "affected", "version": "< 4.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gunet:open_eclass_platform:*:*:*:*:*:*:*:*", "matchCriteriaId": "62F1C084-2C90-4AB3-A13E-28323DC385C0", "versionEndExcluding": "4.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a file upload validation bypass vulnerability allows attackers to upload files with prohibited extensions by embedding them inside ZIP archives and extracting them using the application\u2019s built-in decompression functionality. This issue has been patched in version 4.2."}, {"lang": "es", "value": "La plataforma Open eClass (anteriormente conocida como GUnet eClass) es un sistema completo de gesti\u00f3n de cursos. Antes de la versi\u00f3n 4.2, una vulnerabilidad de omisi\u00f3n de validaci\u00f3n de carga de archivos permite a los atacantes cargar archivos con extensiones prohibidas incrust\u00e1ndolos dentro de archivos ZIP y extray\u00e9ndolos usando la funcionalidad de descompresi\u00f3n incorporada de la aplicaci\u00f3n. Este problema ha sido parcheado en la versi\u00f3n 4.2."}], "id": "CVE-2026-24673", "lastModified": "2026-06-17T10:23:23.877", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24673", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-04T15:46:36.435632Z", "version": "2.0.3"}}]}, "published": "2026-02-03T18:16:24.023", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/gunet/openeclass/security/advisories/GHSA-3g4j-56gp-v6wv"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T14:14:11.233418+00:00", "value": {"mitigation_remediation": ["Upgrade Open eClass to version 4.2 or later to apply the vendor patch.", "Disable automatic extraction of ZIP archives during file uploads if updating to 4.2 is not yet possible.", "Restrict uploaded ZIP contents by enforcing strict file type validation, rejecting prohibited extensions even after extraction.", "Monitor upload logs for anomalous ZIP file uploads that may indicate attempted exploitation."], "summary": {"action": "Apply Patch", "impact": "Unauthorized File Upload \u2013 Potential for Execution"}, "threat_synthesis": {"affected_systems": "The Open eClass course management system, produced by gunet, is affected up to version 4.1. The issue is fixed in version 4.2. Users running earlier releases are vulnerable.", "description_and_impact": "An upload validation bypass allows attackers to embed disallowed file types inside a ZIP archive that the application automatically extracts, enabling the storage of arbitrary files on the server. This flaw (CWE\u2011434) permits files that would normally be rejected by the upload filter to reach the file system and potentially be executed or accessed, leading to data disclosure or platform compromise.", "risk_and_exploitability": "The CVSS score of 4.3 indicates a moderate risk, while the EPSS score of below 1% suggests low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to control the upload interface, create a ZIP with a prohibited file, and initiate the upload; no network access beyond the application layer is required."}}}}, "created": "2026-02-04T12:09:13.648991+00:00", "updated": "2026-04-18T14:15:04.139852+00:00", "vendors": ["openeclass", "openeclass$PRODUCT$openeclass"]}