What’s Vulnerable › Vulnerabilities

CVE-2024-33270

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-04-30 · updated 2026-07-09
• Weakness: CWE-125

Description

An issue in FME Modules fileuploads v.2.0.3 and before and fixed in v2.0.4 allows a remote attacker to obtain sensitive information via the uploadfiles.php component.

Affected products

• PrestaShop: from 2.03 before 2.04 — fixed in 2.04

How to fix

Upgrade to a fixed version: PrestaShop 2.04. Check the vendor advisory for mitigations.

References

• https://addons.prestashop.com/en/additional-information-product-tab/21373-customer-file-upload-attach-file-on-productcart-pages.html
• https://security.friendsofpresta.org/modules/2024/04/29/fileuploads.html
• https://addons.prestashop.com/en/additional-information-product-tab/21373-customer-file-upload-attach-file-on-productcart-pages.html
• https://security.friendsofpresta.org/modules/2024/04/29/fileuploads.html

Get alerted when CVE-2024-33270 or the next vulnerability affects your stack