CVE-2024-3778: Ai3 QbiBot - Unrestricted File Upload

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-04-15 · updated 2026-06-17
Weakness: CWE-434

Description

The file upload functionality of Ai3 QbiBot does not properly restrict types of uploaded files, allowing remote attackers with administrator privilege to upload files with dangerous type containing malicious code.

Affected products

Ai3 QbiBot: all versions

References

https://www.twcert.org.tw/tw/cp-132-7732-9a54e-1.html
https://www.twcert.org.tw/tw/cp-132-7732-9a54e-1.html

Get alerted when CVE-2024-3778 or the next vulnerability affects your stack