Back to Database
Status published
High
CVE-2024-37295
Aimeos Core remote code execution in web server context
Vulnerability Description
Aimeos is an Open Source e-commerce framework for online shops. Starting in version 2024.01.1 and prior to version 2024.04.5, a user with administrative privileges can upload files that look like images but contain PHP code which can then be executed in the context of the web server. Version 2024.04.5 fixes the issue.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-37295
Credits & Attribution
No credits recorded in the NVD database.
More from aimeos
View All →CVE-2025-66468
Aimeos GrapesJS CMS extension possible stores XSS exploitable by authenticated editors
High
7.7
CVE-2024-47173
Aimeos GraphQL API admin interface denial of service vulnerability in SaaS and marketplace setups
Medium
5.5
CVE-2024-39325
aimeos/ai-controller-frontend doesn't reset payment status in basket
Medium
5.3
CVE-2024-39324
aimeos/ai-admin-graphql improper access control vulnerability allows editors to manage own services
Low
3.8
CVE-2024-39323
aimeos/ai-admin-graphql improper access control vulnerability allows an editor to modify admin account
High
7.1
Affected Vendor
aimeos
View all reports →Affected Software
aimeos-core
Vulnerable Versions:
>= 2024.04.1, < 2024.04.5
Timeline
Official Publish:
June 11th, 2024
Last Modified:
August 2nd, 2024
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H