CVE-2024-50623: Cleo Multiple Products Unrestricted File Upload Vulnerability

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: yes — in CISA KEV since 2024-12-13
EPSS: 98.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-10-28 · updated 2026-10-08
Weakness: CWE-434

Description

In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.

Affected products

Cleo Harmony: before 5.8.0.21 — fixed in 5.8.0.21
Cleo Lexicom: before 5.8.0.21 — fixed in 5.8.0.21
Cleo Vltrader: before 5.8.0.21 — fixed in 5.8.0.21

How to fix

Upgrade to a fixed version: Cleo Harmony 5.8.0.21; Cleo Lexicom 5.8.0.21; Cleo Vltrader 5.8.0.21. Check the vendor advisory for mitigations.

References

https://support.cleo.com/hc/en-us/articles/27140294267799-Cleo-Product-Security-Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-50623

Get alerted when CVE-2024-50623 or the next vulnerability affects your stack