CVE-2024-13144 is a medium severity (CVSS 6.3) unrestricted file upload in zhenfeng13 My-Blog 1.0, in the uploadFileByEditomd function of BlogController.java. The record says the exploit has been disclosed publicly and names no fix. If you run this blog engine, restrict access to the admin area and check the issue.
What's affected
- zhenfeng13 My-Blog version 1.0.
- The affected function is uploadFileByEditomd in src/main/java/com/site/blog/my/core/controller/admin/BlogController.java, through the editormd-image-file argument.
The record names no fixed version, and it describes the exploit as publicly disclosed. Check the project's issue tracker and repository for a patch. If none exists, treat the project as unfixed.
How to check if you're exposed
Run the check below, or read the vendor or project notes linked in Sources.
# Look at your build file for the project and its version
grep -n -i my-blog pom.xml
Compare the result to the affected range above.
What to do now
- Find any deployment of My-Blog 1.0 and decide whether it needs to be reachable from the internet.
- Review the linked issue for any maintainer guidance.
- Make uploaded files non-executable and serve them from a separate path, so an uploaded file can never be run as code.
- Add server side checks of file type, size and name for the editormd upload endpoint.
- Look up CVE-2024-13144 on its Gold page to see the current details and any fix information.
- Check your own dependency files with the free in-browser dependency scan. It runs in your browser and does not send the file to a server.
Why it matters
The record lists CWE-284 for improper access control alongside CWE-434 for unrestricted upload. The vector requires a low privilege account, so the endpoint sits behind a login but does not constrain what a logged in user can send. This is the same pattern seen in the sibling CVE-2024-13145, which hits a different upload function in the same project.
Small open source blog engines often grow upload features quickly and skip the checks. If you adopted one for a side project that became a real site, treat the admin area as part of your attack surface.
This CVE is an arbitrary file upload flaw (CWE-284, CWE-434, Improper Access Control and Unrestricted File Upload). Nothing in the record says it is exploited in the wild, and it is not marked as listed in CISA's Known Exploited Vulnerabilities catalog. That is a snapshot, so keep checking.
File upload handlers are risky because the server ends up storing something a stranger chose. If the handler does not check the file type properly, a file that the web server treats as code can end up in a web-reachable folder, and code that runs on your server is the start of a full compromise.
The usual defenses are an allowlist of file types checked on the server, renaming uploads, storing them outside the web root or with script execution turned off, and requiring authentication where possible. Double extension tricks work only on some server configurations, which is why the advisory language is conditional. The attack complexity is rated high for that reason.
Quick check
Does the attacker need to be logged in?
The CVSS vector lists low privileges required, so some account is needed.
Is it related to CVE-2024-13145?
Both are upload flaws in My-Blog 1.0, in different functions.
Sources
Note: these pages could not be retrieved when this post was written, so statements rest on the CVE record text. Check the vendor pages for the latest version information.
Last reviewed: 19 October 2026.
