What’s Vulnerable › Vulnerabilities

CVE-2024-50620

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-11 · updated 2026-06-17
• Weakness: CWE-434

Description

Unrestricted Upload of File with Dangerous Type vulnerabilities exist in the rich text editor and document manage components in CIPPlanner CIPAce before 9.17. An authorized user can upload executable files when inserting images in the rich text editor, and upload executable files when uploading files on the document management page. Those executables can be executed if they are not stored in a shared directory or if the storage directory has executed permissions.

Affected products

• Cipplanner Cipace: before 9.17 — fixed in 9.17

How to fix

Upgrade to a fixed version: Cipplanner Cipace 9.17. Check the vendor advisory for mitigations.

References

• https://cipplanner.com/cve-2024-50620-cve-public-notification-of-resolution/
• https://www.facebook.com/people/CIPPlanner-Corporation/100082985059905/

Get alerted when CVE-2024-50620 or the next vulnerability affects your stack