Freo2
Monthly
Unrestricted file upload in freo2 (by refirio) versions prior to 2.0.0-alpha-14 enables highest-privilege administrative users to upload executable files and trigger arbitrary OS command execution on the underlying server. Reported by JPCERT and covered under JVN#52865575, this is a post-authentication code execution path requiring no user interaction once admin access is established. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unrestricted file upload in freo2 (by refirio) versions prior to 2.0.0-alpha-14 enables highest-privilege administrative users to upload executable files and trigger arbitrary OS command execution on the underlying server. Reported by JPCERT and covered under JVN#52865575, this is a post-authentication code execution path requiring no user interaction once admin access is established. No public exploit code or CISA KEV listing has been identified at time of analysis.