CVE-2024-32491: 
Linux Debian vulnerability analysis and mitigation

An issue was discovered in Znuny and Znuny LTS versions 6.0.31 through 6.5.7 and Znuny versions 7.0.1 through 7.0.16. The vulnerability allows a logged-in user to upload a file via a manipulated AJAX Request to an arbitrary writable location by traversing paths. This vulnerability was discovered and reported by Martino Spagnuolo and was assigned CVE-2024-32491 (Znuny Advisory).

The vulnerability is classified as a Code Injection vulnerability (CWE-94) with a CVSS v3.1 Base Score of 9.8 (CRITICAL) and vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The issue allows path traversal through manipulated AJAX requests, potentially leading to arbitrary code execution if the upload location is publicly accessible through the web server (NVD).

If exploited, this vulnerability could lead to arbitrary code execution on the affected system when the uploaded file location is publicly accessible through the web server. This presents a critical security risk as it could allow attackers to execute malicious code and potentially take control of the affected system (Znuny Advisory).

The vulnerability requires an authenticated user to exploit, but has low attack complexity. The attack vector is network-accessible, and no user interaction is required beyond the initial authentication (NVD).

Users should upgrade to the latest version of Znuny that addresses this vulnerability. The issue has been fixed in versions newer than 6.5.7 for Znuny LTS and versions newer than 7.0.16 for Znuny (Znuny Advisory).