CVE-2024-0352 is a high severity (CVSS 7.3) unrestricted file upload weakness in Likeshop. No fixed version is confirmed in the record, so check the vendor or project page. The record says an exploit has been disclosed to the public. It is not listed as exploited in the wild by CISA.
What's affected
Likeshop up to and including 2.5.7.20210311. The vulnerable function is FileServer::userFormImage in server/application/api/controller/File.php, in the HTTP POST request handler, and the manipulated argument is file.
The weakness is mapped to CWE-434, unrestricted upload of a file with a dangerous type. The record was published on 2024-01-09. The record's KEV flag is false, so CISA does not list it in the Known Exploited Vulnerabilities catalog.
The sources disagree on severity. The description, which comes from VulDB, calls the issue critical. NVD's CVSS 3.1 score is 7.3, which is High, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. Both ratings are published. Plan around the rating that matches your exposure: an internet facing copy deserves the more urgent reading.
How to check if you're exposed
This is software you install yourself or an appliance, so start from your own inventory. Find where the product runs, read its version from the application, its package metadata or its install directory, and compare it to the range above.
grep -ril "'+d['short'].split('-')[0]+'" /var/www 2>/dev/null
That searches a typical web root for the product name, so adjust the path to your server. For code you maintain, search for the file and parameter named in the record and read how the value is used.
You can also paste a manifest or SBOM into the free in-browser scanner at Safeguard Gold to see which known CVEs apply to your dependencies. It only covers components that appear in a manifest or SBOM, so a standalone appliance still needs the manual check.
What to do now
- Find every deployment of Likeshop in your environment, including test systems and anything bought or installed by a team outside IT.
- Check the vendor or project page for a fixed release. None is confirmed in the record, so do not assume that upgrading to the latest version resolves it until the notes say so.
- Make sure the upload directory does not allow script execution in the web server configuration.
- Check the upload folder for files you do not recognise, especially script files.
- Restrict the upload feature to authenticated, trusted users where it is needed at all, and remove it where it is not.
- Re-run a scan after the change and record the date, so you can show the exposure is closed.
Why it matters
Unrestricted upload means the application accepts a file without properly checking its type, name or destination. If an uploaded file ends up somewhere the web server will run it, the upload becomes a way to run code on the server.
The usual fix is a strict allow list of file types checked on the server, storage outside the web root, random file names and no script execution in the upload directory.
The CVSS vector reads as follows. The attack is possible over the network, attack complexity is low, privileges required are none, and user interaction is not needed. The impact on confidentiality, integrity and availability is limited, limited and limited respectively. A score is a starting point. Your own exposure, meaning whether the product faces the internet and what it can reach, decides the real priority.
Quick check
Is this vulnerability known to be exploited in the wild?
The record's KEV flag is false, so CISA does not list it in the Known Exploited Vulnerabilities catalog. The description says an exploit has been disclosed to the public, which is not the same as confirmed attacks. Treat the public disclosure as a reason to act sooner.
Which versions are fixed?
The record does not confirm a fixed version, and the vendor reference could not be retrieved. Check the vendor or project page, and if none is available, restrict access to the product or replace it.
Sources
The vendor and researcher references listed in the NVD record could not be retrieved when this post was written, so the details above come from the NVD record itself.
Last reviewed: 19 October 2026.
