Read the docs
TI-2024-10481 Aliases CVE-2024-11315GHSA-pr37-gvg2-qr9v

TRCore DVC - Arbitrary File Upload through Path Traversal

Priority MEDIUM 52CWE-23Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to upload arbitrary files to any directory, leading to arbitrary code execution by uploading webshells.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01388 72nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TRCoreDVC6.0 – 6.3—No fix listedCNA
  • DVC VendorTRCore Affected 6.0 – 6.3 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:trcore:dvc:*:*:*:*:*:*:*:*6.0 to before 6.4VulnerableTRCore
  • cpe:2.3:a:trcore:dvc:*:*:*:*:*:*:*:* Versions 6.0 to before 6.4 Vulnerable ·TRCore

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-11315
  2. 2026-10-03 Alias added: GHSA-pr37-gvg2-qr9v

References

Advisory 2

  • TI-2024-10480 TRCore DVC - Arbitrary File Upload through Path Traversal CVSS 3.1CRITICAL 9.8
  • TI-2024-10479 TRCore DVC - Arbitrary File Upload through Path Traversal CVSS 3.1CRITICAL 9.8
  • TI-2024-10478 TRCore DVC - Arbitrary File Upload through Path Traversal CVSS 3.1CRITICAL 9.8
  • TI-2024-10477 TRCore DVC - Arbitrary File Upload through Path Traversal CVSS 3.1CRITICAL 9.8
  • TI-2024-10476 TRCore DVC - Arbitrary File Read through Path Traversal CVSS 3.1HIGH 7.5
  • TI-2024-10475 TRCore DVC - Arbitrary File Read through Path Traversal CVSS 3.1HIGH 7.5
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences