CVE-2024-1259 is a medium severity unrestricted file upload in Juanpao JPShop, up to version 1.5.02, in the admin app controller. NVD scores it 6.3 and the record says exploit details are public. No fixed version is confirmed, so restrict access and ask the vendor.
What's affected
The record names Juanpao JPShop, up to version 1.5.02. The weak spot is the file api/controllers/admin/app/AppController.php, with the app_pic_url argument. The remote attack path and the public disclosure both come from the VulDB entry, number 252998, which the record paraphrases.
NVD scores it 6.3, which is Medium. The vector needs a low privilege account, which is why the score is 6.3.
No fixed version is stated in the record. Ask the vendor for a patched release and treat every JPShop version up to 1.5.02 as affected.
This is one of six upload flaws reported in the same shop software, CVE-2024-1259 to CVE-2024-1264, each in a different controller. Together they suggest the whole upload path needs review, not a single file.
Weakness class: CWE-434. The NVD record carries the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L and a score of 6.3.
How to check if you're exposed
Look at the file named in the record, the file api/controllers/admin/app/AppController.php, and at the upload folder it writes to. Search that folder for script files such as PHP that arrived recently and that no one on your team added.
If you are not sure whether the product is installed, search your server inventory and application list for its name, since small business software like this often sits on a single forgotten host.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan for the libraries in your own projects, and reachability analysis helps you tell which findings your code actually calls.
What to do now
- Find every installation of Juanpao JPShop and record the version.
- Ask the vendor for a patched release and apply it as soon as it is available.
- Until a fix exists, limit who can reach the application, for example by placing it behind a VPN or an allow list, and block public access to the file api/controllers/admin/app/AppController.php.
- Watch web server logs for requests to the affected route and for new or changed files.
- Plan a move to a maintained product if the vendor does not respond.
Why it matters
Unrestricted upload (CWE-434) means the app_pic_url input is accepted without enough checks on file type or content. A safe handler allows a short list of extensions, checks the content, stores the file outside the web root or in a folder that cannot run scripts, and renames it.
If an uploaded script can be requested through the web server, it may run with the server's rights. The record does not claim code execution, so treat that as the risk to test for, not as a stated fact. The record does not say the vendor responded, so do not count on a patch arriving.
Quick check
Is CVE-2024-1259 known to be exploited?
The KEV flag in the record is false. The record does say the exploit details have been disclosed publicly, so do not wait for exploitation reports before acting.
Where can I read the original report?
The record cites VulDB entry 252998 and an outside write up. I could not retrieve them, so check them yourself for the proof of concept level detail, which this post leaves out on purpose.
Sources
- NVD record for CVE-2024-1259
- VulDB entry cited in the record (not retrieved)
- Write up cited in the record (not retrieved)
Last reviewed: 19 October 2026.
