CVE-2024-2406 is a medium severity unrestricted file upload in Gacjie Server up to 1.0, scored 5.4 by NVD. The record lists no fixed release, so there is no confirmed patch to install. Restrict access to the affected component, correct the code if you own it, or retire the software.
Weakness: CWE-434 (Unrestricted Upload of File with Dangerous Type).
What's affected
- Affected: Gacjie Server, up to 1.0, as listed in the NVD record.
- Fixed: none named. The record names no fixed release for Gacjie Server. Treat the software as unpatched until the vendor or the project says otherwise.
- Attack conditions: the CVSS vector is
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, which means network reachable, a low-privilege account needed, and the attack needs no user interaction.
The record says the flaw sits in the file /app/admin/controller/Upload.php, and that the manipulation of the argument file is what triggers it. The record also says the exploit has been disclosed to the public, which is why the exposure window matters whatever the score.
How to check if you're exposed
This is a standalone application, not a package on a registry, so there is no package manager command that reports it. Work through these steps instead.
- Search your hosting inventory, source repositories and deployment folders for the project name (Gacjie Server).
- Open the installed copy and confirm whether it is version up to 1.0. If the version is not recorded, assume it is affected.
- Check whether /app/admin/controller/Upload.php can be reached from outside your network and who can authenticate to it.
- Review web server access logs for unexpected requests to that path, and keep the logs you find.
If you track dependencies, the free in-browser dependency scan can show whether a library or package in your project matches a known CVE. It will not find a standalone PHP application or a firmware image that was never packaged as a dependency, so keep your own inventory of those.
What to do now
- Find every deployment of Gacjie Server and decide whether it needs to be online at all. Many of these projects are tutorial or demo code.
- Look for a vendor or upstream update. The record names none, so check the project repository and the VulDB entry linked in the sources.
- Put the application behind authentication and a network allow list, or take it offline, until a fix exists.
- If you own the code, accept only an allow list of file types, check content as well as extension, rename files on save, and store them outside the web root with script execution disabled.
- Record the exception in your risk register with an owner and a review date.
Why it matters
Unrestricted upload means the server accepts a file without checking that it is the kind of file it expects. If the stored file can later be served or run as a script, an upload feature becomes a way to place code on the server. The defence is to validate type and content, rename the file and keep it where it cannot execute.
The record classes this as CWE-434 (Unrestricted Upload of File with Dangerous Type). NVD scored it 5.4 (Medium) with CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. The KEV flag in the record is false, so CISA's Known Exploited Vulnerabilities catalog does not list it, though the record notes public disclosure of the exploit. Small open source and sample style applications like this one often never get patched, so the control you have is exposure, not a version bump.
Quick check
Is there a patch for CVE-2024-2406?
The record lists no fixed version for Gacjie Server. Check the project repository and the VulDB entry before assuming one exists, and plan around restricting access in the meantime.
Is this being exploited in the wild?
The record's KEV flag is false and no advisory we reviewed reports exploitation. The record does say the exploit details were published, so a copy of the technique is available to anyone.
Sources
- CVE-2024-2406 record on Safeguard Gold
- NVD description and CVSS vector for CVE-2024-2406, as held in the batch record
- VulDB entry for this CVE, linked from the record (see the Gold page for the reference list)
Last reviewed: 19 October 2026.
