CVE-2024-1659 is a critical (CVSS 9.8) arbitrary file upload flaw in MegaBIP, a Polish public information bulletin system. An attacker can upload any file, including a PHP file, without authentication. It affects versions through 5.10, and CERT Polska coordinated disclosure on 12 June 2024.
What's affected
CERT Polska's post of 12 June 2024 covers three MegaBIP issues from its own research. For this one it lists the vendor as Jan Syski, the product as MegaBIP and the vulnerable versions as all through 5.10, with the type unrestricted upload of file with dangerous type (CWE-434 (unrestricted upload of file with dangerous type)). The NVD record gives 9.8 (critical).
The same post describes CVE-2024-1576, an SQL injection through 5.09, and CVE-2024-1577, code execution through 5.11.2. If you run MegaBIP you should look at all three. The post does not name a fixed version for this CVE, so check the vendor site and the Polish government recommendation listed in the record.
How to check if you're exposed
Check the MegaBIP version in the administration panel or the site footer. Anything at or below 5.10 is affected by this CVE, and anything up to 5.11.2 by the code execution issue. Then look for unexpected files in upload directories.
find /path/to/megabip/uploads -type f -name "*.php*"
Any script file in an upload directory that you did not put there needs investigation. Also review web server logs for upload requests from addresses you do not recognize.
What to do now
- Update MegaBIP to the latest release from the vendor and confirm the version afterwards.
- Remove or block script execution in upload directories at the web server.
- Review the site for unexpected PHP files and unfamiliar admin accounts, then reset admin passwords.
- Read the CERT Polska post and the Polish government recommendation for the full set of issues.
- Restrict the administration area to trusted networks where you can.
Why it matters
Unrestricted upload is a classic path to code execution on web servers. If the server accepts a file and stores it where the web server will run it, the attacker gets to run their own code. The usual defenses are an allow list of file types, storing uploads outside the web root and turning off script execution there.
The score is 9.8 because no login is needed and the impact is high across the board. Public bulletin sites are run by many small bodies and are easy to find, so CERT Polska and the Polish government published recommendations. The record's KEV flag is false. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan can show whether a component tied to this CVE appears in your dependency manifests. The Gold directory keeps the record, severity and references in one place, and reachability analysis helps you separate code paths that can actually be hit from packages that are merely installed.
Quick check
Which versions are affected?
CERT Polska lists all versions through 5.10 for this CVE. The post does not name a fixed version, so check the vendor.
Sources
Last reviewed: 19 October 2026.
