High severity7.2OSV Advisory· Published Jun 11, 2024· Updated Apr 15, 2026

CVE-2024-37295

Description

Aimeos is an Open Source e-commerce framework for online shops. Starting in version 2024.01.1 and prior to version 2024.04.5, a user with administrative privileges can upload files that look like images but contain PHP code which can then be executed in the context of the web server. Version 2024.04.5 fixes the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
aimeos/aimeos-corePackagist	>= 2024.04.1, < 2024.04.5	2024.04.5

Affected products

Aimeos/Aimeos CoreOSV
Range: 2024.04.1, 2024.04.2, 2024.04.3, …
ghsa-coords
pkg:composer/aimeos/aimeos-core
Range: >= 2024.04.1, < 2024.04.5

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-rhc2-23c2-ww7cghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2024-37295ghsaADVISORY
github.com/aimeos/aimeos-core/security/advisories/GHSA-rhc2-23c2-ww7cnvdWEB

News mentions

No linked articles in our index yet.

cvss	0.468
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000