CVE-2024-11312: TRCore DVC - Arbitrary File Upload through Path Traversal

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-11-18 · updated 2026-06-17
Weakness: CWE-23

Description

The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to upload arbitrary files to any directory, leading to arbitrary code execution by uploading webshells.

Affected products

TRCore DVC: from 6.0 before 6.4 — fixed in 6.4

How to fix

Upgrade to a fixed version: TRCore DVC 6.4. Check the vendor advisory for mitigations.

References

https://www.twcert.org.tw/en/cp-139-8249-65252-2.html
https://www.twcert.org.tw/tw/cp-132-8248-8dac9-1.html

Get alerted when CVE-2024-11312 or the next vulnerability affects your stack