CVE-2022-24262
Description
The config restore function of Voipmonitor GUI before v24.96 does not properly check files sent as restore archives, allowing remote attackers to execute arbitrary commands via a crafted file in the web root.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Voipmonitor/GUIdescription
- Range: <24.96
Patches
Vulnerability mechanics
Root cause
"Missing validation of archive contents in the config restore function allows arbitrary file extraction into the web root."
Attack vector
An attacker with access to the config restore functionality uploads a crafted archive (e.g., a ZIP or tar file) containing a PHP file. Because the restore function does not check the contents of the archive before extracting it into the web root [ref_id=1], the attacker's file is placed in a web-accessible directory. The attacker then requests that file via HTTP, causing the server to execute arbitrary PHP commands.
Affected code
The config restore function in the VoIPmonitor GUI (before v24.96) does not validate files sent as restore archives. The advisory does not specify exact file paths or function names, but the vulnerability lies in the archive extraction logic that places files into the web root without sanitization.
What the fix does
The changelog for v24.96 does not explicitly describe a patch for this specific vulnerability [ref_id=1]. The advisory indicates the issue was fixed in v24.96, but no diff or remediation details are provided in the available reference. Users should upgrade to VoIPmonitor GUI v24.96 or later to receive the fix.
Preconditions
- authAttacker must have access to the config restore function (typically an admin-level user).
- inputAttacker must be able to upload a crafted archive file to the server.
Generated on May 28, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
2- kerbit.io/research/read/blog/3mitrex_refsource_MISC
- www.voipmonitor.org/changelog-guimitrex_refsource_MISC
News mentions
0No linked articles in our index yet.