High severity7.2NVD Advisory· Published Jun 11, 2024· Updated Apr 15, 2026

CVE-2024-37295

Description

Aimeos is an Open Source e-commerce framework for online shops. Starting in version 2024.01.1 and prior to version 2024.04.5, a user with administrative privileges can upload files that look like images but contain PHP code which can then be executed in the context of the web server. Version 2024.04.5 fixes the issue.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
aimeos/aimeos-corePackagist	>= 2024.04.1, < 2024.04.5	2024.04.5

Patches

5eea7aa933ac

https://github.com/aimeos/aimeos-corevia osv

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

github.com/advisories/GHSA-rhc2-23c2-ww7cghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2024-37295ghsaADVISORY
github.com/aimeos/aimeos-core/security/advisories/GHSA-rhc2-23c2-ww7cnvdWEB

News mentions

No linked articles in our index yet.

cvss	0.468
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000