Read the docs
TI-2024-24807 Aliases CVE-2024-37295GHSA-rhc2-23c2-ww7c

Aimeos Core remote code execution in web server context

Priority LOW 35CWE-73Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Aimeos is an Open Source e-commerce framework for online shops. Starting in version 2024.01.1 and prior to version 2024.04.5, a user with administrative privileges can upload files that look like images but contain PHP code which can then be executed in the context of the web server. Version 2024.04.5 fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00607 49th percentileScored 2026-11-07
Fix Fixed aimeos-core (aimeos): 2024.04.5aimeos/aimeos-core (Packagist): 2024.04.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
aimeosaimeos-core2024.04.1 to before 2024.04.52024.04.5Patch availableCNA
—aimeos/aimeos-core (Packagist)2024.04.1 to before 2024.04.52024.04.5Patch availableGHSA-rhc2-23c2-ww7c
  • aimeos-core Vendoraimeos Affected 2024.04.1 to before 2024.04.5 Fixed in 2024.04.5 Patch available CNA
  • aimeos/aimeos-core (Packagist) Vendor— Affected 2024.04.1 to before 2024.04.5 Fixed in 2024.04.5 Patch available GHSA-rhc2-23c2-ww7c

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:aimeos:aimeos-core:*:*:*:*:*:*:*:*——aimeos
  • cpe:2.3:a:aimeos:aimeos-core:*:*:*:*:*:*:*:* Versions — — ·aimeos

Remediation

  • Fix · CNA aimeos-core (aimeos) Fixed in 2024.04.5
  • Fix · GHSA-rhc2-23c2-ww7c aimeos/aimeos-core (Packagist) Fixed in 2024.04.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-37295
  2. 2026-10-03 Alias added: GHSA-rhc2-23c2-ww7c

References

Advisory 1

Other 2

  • TI-2021-22379 Aimeos Laravel ecommerce platform 2021.10 LTS - 'sort' SQL injection CVSS 4.0HIGH 8.8
  • TI-2024-25751 Aimeos HTML client may potentially reveal sensitive information in error log CVSS 3.1HIGH 8.8
  • TI-2025-40895 Aimeos GrapesJS CMS extension possible stores XSS exploitable by authenticated editors CVSS 3.1HIGH 7.7
  • TI-2024-26279 aimeos/ai-admin-graphql improper access control vulnerability allows an editor to modify admin account CVSS 3.1HIGH 7.1
  • TI-2024-26275 aimeos/ai-controller-frontend has IDOR vulnerability in account profile page CVSS 3.1MEDIUM 5.3
  • TI-2024-31541 Aimeos GraphQL API admin interface denial of service vulnerability in SaaS and marketplace setups CVSS 3.1MEDIUM 5.5
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences