PatchTheCVECVE-2024-0352: A vulnerability classified as critical was found in Likeshop up to 2.5.7.20210311
CVE-2024-0352 is a high-severity flaw (CVSS 7.3) affecting likeshop. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A vulnerability classified as critical was found in Likeshop up to 2.5.7.20210311. This vulnerability affects the function FileServer::userFormImage of the file server/application/api/controller/File.php of the component HTTP POST Request Handler. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerabili
Why this priority
- High severity
- EPSS top 1%: very likely to be exploited
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.3 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 72.9% (top 1%) |
| CISA exploited list | No |
| Weakness | CWE-434 |
| Published | 2024-01-09 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- Nuclei scan template: Likeshop < 2.5.7.20210311 - Arbitrary File Upload
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2024-0352?
likeshop: upgrade to newer than 2.5.7.20210311. Exact commands for each OS are on this page.
Is CVE-2024-0352 being exploited?
CVE-2024-0352 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2024-0352 affect?
CVE-2024-0352 affects likeshop. Severity is high (CVSS 7.3). A vulnerability classified as critical was found in Likeshop up to 2.5.7.20210311. This vulnerability affects the function FileServer::userFormImage of the file server/application/api/controller/File.php of the component HTTP POST Request H
How urgent is CVE-2024-0352?
Priority 55/100. High severity; EPSS top 1%: very likely to be exploited; Remotely exploitable, no login, no user action
Software pages
Related CVEs
- CVE-2024-5766 LOW 2.4 UPGRADE A vulnerability was found in Likeshop up to 2.5.7 and classified as problematic
- CVE-2024-41432 MEDIUM 5.3 UPGRADE An IP Spoofing vulnerability has been discovered in Likeshop up to 2.5.7.20210811
- CVE-2024-34949 HIGH 8.2 UPGRADE SQL injection vulnerability in Likeshop before 2.5.7 allows attackers to run abitrary SQL commands via the fun
- CVE-2024-24028 MEDIUM 5.9 UPGRADE Server Side Request Forgery (SSRF) vulnerability in Likeshop before 2.5.7 allows attackers to view sensitive i
- CVE-2024-24027 HIGH 7.2 UPGRADE SQL Injection vulnerability in Likeshop before 2.5.7 allows attackers to run abitrary SQL commands via the fun