CVE-2024-44373
Published: 19 August 2025
Summary
CVE-2024-44373 is a critical-severity Path Traversal (CWE-22) vulnerability in Wordpress (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 18.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-25 (Reference Monitor) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2024-44373 is a path traversal vulnerability (CWE-22) affecting AllSky software versions from v2023.05.01 through v2024.12.06_06. The flaw resides in the /includes/save_file.php endpoint, where the path and content parameters are improperly handled, enabling an unauthenticated attacker to write arbitrary files. This leads to the creation of a webshell and subsequent remote code execution. The vulnerability has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), classifying it as critical.
Any unauthenticated attacker with network access can exploit this vulnerability due to its low complexity and lack of prerequisites. By crafting malicious requests to the vulnerable endpoint, the attacker can upload a webshell, gaining persistent remote code execution on the affected AllSky instance. This could allow full server compromise, including data exfiltration, lateral movement, or further persistence.
Advisories and references, including the research post at gh0stmezh.wordpress.com, the AllSky GitHub repository, the specific save_file.php source code, and a Notion page detailing the CVE, provide additional technical analysis. Security practitioners should review these for patch status or workarounds, as no specific mitigation details are outlined in the core CVE description.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-54888
Vulnerability details
A Path Traversal vulnerability in AllSky v2023.05.01 through v2024.12.06_06 allows an unauthenticated attacker to create a webshell and remote code execution via the path, content parameter to /includes/save_file.php.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal on public-facing web endpoint enables unauthenticated arbitrary file write for webshell deployment and RCE.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of path and content parameters at input interfaces to directly block path traversal exploitation in save_file.php.
Implements a reference monitor to enforce file access policies, preventing unauthorized writes to arbitrary paths targeted by traversal attacks.
Boundary protection at web interfaces filters malicious path traversal payloads and monitors unauthenticated requests to the vulnerable endpoint.