Dotclear 2.29 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the media upload functionality. Attackers can exploit the file upload process by crafting a PHP shell with a command execution form to gain system access through the uploaded file.
References
| Link | Resource |
|---|---|
| https://git.dotclear.org/explore/repos | Broken Link |
| https://github.com/dotclear/dotclear/archive/refs/heads/master.zip | Product |
| https://www.exploit-db.com/exploits/52037 | Exploit Third Party Advisory |
| https://www.vulncheck.com/advisories/dotclear-remote-code-execution-via-authenticated-file-upload | Third Party Advisory |
| https://github.com/dotclear/dotclear/archive/refs/heads/master.zip | Product |
Configurations
History
19 Dec 2025, 17:50
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:dotclear:dotclear:2.29:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| First Time |
Dotclear
Dotclear dotclear |
|
| References | () https://git.dotclear.org/explore/repos - Broken Link | |
| References | () https://github.com/dotclear/dotclear/archive/refs/heads/master.zip - Product | |
| References | () https://www.exploit-db.com/exploits/52037 - Exploit, Third Party Advisory | |
| References | () https://www.vulncheck.com/advisories/dotclear-remote-code-execution-via-authenticated-file-upload - Third Party Advisory |
11 Dec 2025, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/dotclear/dotclear/archive/refs/heads/master.zip - |
10 Dec 2025, 22:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-10 22:16
Updated : 2025-12-19 17:50
NVD link : CVE-2024-58281
Mitre link : CVE-2024-58281
CVE.ORG link : CVE-2024-58281
JSON object : View
Products Affected
dotclear
- dotclear
CWE
CWE-434
Unrestricted Upload of File with Dangerous Type