CVE-2024-1925 is a medium severity (CVSS 5.0) unrestricted file upload flaw in Ctcms 2.1.2. The weakness sits in ctcms/apps/controllers/admin/Upsys.php. The record lists no fixed version, so check with the vendor, restrict access to the product and plan a replacement if no patch ships.
What's affected
NVD lists Ctcms 2.1.2 as affected. The record names no fixed version, and the references are third party write ups rather than a vendor advisory. If you run this product, contact the vendor or check its project page for a patched release before relying on any version number you read here.
NVD scores this 5.0 (Medium) with vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L. VulDB calls it critical, while NVD scores it 5.0 (Medium), reflecting high attack complexity. The description says the exploit has been disclosed to the public, so assume that details are available to anyone who looks.
How to check if you're exposed
Ctcms is a stand-alone application, so there is no registry package to query. Look in your asset inventory, deployment records or hosting panel for it, and read the installed version from the application itself or its install directory. Anything at the version named above is in scope.
The affected code is reached through ctcms/apps/controllers/admin/Upsys.php. If that path is reachable from the internet or from a wide internal network, treat the exposure as higher. Your web server and application logs for requests to that path are a reasonable place to look for unusual activity, though a clean log does not prove the path was never used.
What to do now
- Find every instance of Ctcms you operate, including test and forgotten copies.
- Ask the vendor or check the project page for a fixed release, and apply it as soon as one exists.
- Review the related application logs, and the database or upload directory contents if relevant, for signs that the weak path was used before you changed anything.
- If no fix exists and you cannot retire the product, restrict network access to it with a firewall or reverse proxy allow list and monitor it closely.
- Add the product to your vulnerability tracking so a later fix or advisory is not missed.
Why it matters
NVD tags this as CWE-434. Unrestricted upload means the application accepts a file without properly limiting its type, name or destination. If an uploaded file can be stored somewhere the web server will execute it, an upload becomes code execution on the server.
Safe designs check the type against an allow list, rename files on arrival, store them outside the web root or on separate storage, and serve them with a content type that browsers and servers will not execute.
Products in this category tend to be small, single maintainer or niche vendor applications. Many never receive a patch, and the NVD note on several of these records says the vendor did not respond to disclosure. That does not make the finding less real. It means the practical controls are network restriction, a web application firewall rule, monitoring and, over time, replacement. The record's KEV flag is false and no source here reports exploitation in the wild beyond the public disclosure. You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which of your projects pull in the affected component. Safeguard reachability analysis can then help you separate code paths that actually call the weak component from those that only list it.
Quick check
Is there a fixed version of Ctcms?
Not in the NVD record. Check the vendor or project page, and treat the product as unpatched until you confirm otherwise.
Why does this matter if the score is medium?
The score reflects the technical impact and conditions in the NVD vector. Public disclosure and low attack complexity raise the chance that someone tries it against an exposed instance.
Sources
Last reviewed: 19 October 2026.
