CVE-2024-0505 is a medium severity (5.5) unrestricted file upload in Austin. It affects Austin 1.0 by ZhongFuCheng3y. The record names no fixed version. Treat the product as exposed until you confirm the version and restrict who can reach it. Check it this week.
What's affected
- Product and location: Austin 1.0 by ZhongFuCheng3y, in the getFile function of MaterialController.java in the Upload Material menu.
- The record says an exploit has been disclosed publicly. The CVSS vector uses adjacent network access and low privileges, which is why the score is 5.5 even though the CNA text calls the issue critical.
- Fixed version: The record names no fixed version.
- Severity: NVD scores it 5.5 (Medium), vector CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. The disclosure text calls the issue critical, while the NVD score is medium. Both figures are shown so you can judge for yourself.
- Published: 2024-01-13.
- The record says the exploit has been disclosed to the public and may be used.
How to check if you're exposed
- Find the deployed application and read its version from the build file or release tag.
- Check whether the upload feature is reachable from your network and who has accounts.
- Review the upload storage directory for files that do not belong, such as scripts or unexpected extensions.
Keep a record of what you find. An inventory that lists the product, version and owner turns the next advisory into a lookup instead of a search. Safeguard's dependency scan runs in the browser for the software you build.
What to do now
- Confirm whether you run the product and which version, using the checks above.
- Look for a vendor update. If none exists, assume the product stays unpatched.
- Allow only the file types the feature needs, checked on the server and not just in the browser.
- Store uploads outside the web root and serve them with a fixed content type.
- Rename stored files instead of trusting the supplied name.
- Run the free dependency scan at gold.safeguard.sh/scan on projects of yours that bundle similar components, and look the CVE up in the Gold directory.
Why it matters
The weakness is CWE-434, unrestricted upload of a file with a dangerous type. An upload feature that does not check what it accepts, where it stores it, or how it is served later can let a user place content on the server that was never meant to be there.
The risk depends on what the application does with stored files. If they are only downloaded, the damage is limited. If the web server can execute or render them, the impact grows. That is why upload handlers deserve the same review as any other input path.
The record lists CWE-434 for this CVE and carries no CISA Known Exploited Vulnerabilities flag. The scores in this post come from NVD and may be revised.
Quick check
Does this need a login?
The record's CVSS vector lists low privileges required, so an authenticated account is assumed. Treat any user account with access to the upload menu as in scope.
Sources
I did not fetch the pages below, so every statement here comes from the NVD record. The VulDB entry and researcher write ups were not independently confirmed.
- https://github.com/biantaibao/Austin-CMS-report/blob/main/File%20Upload%20Vulnerabilities.md
- https://vuldb.com/?ctiid.250619
- https://vuldb.com/?id.250619
Last reviewed: 19 October 2026.
