CVE-2024-2561 is a medium severity (CVSS 6.3) unrestricted file upload in 74CMS 3.28.0. The sendCompanyLogo function in the company controller accepts the imgBase64 argument without enough checks. The record lists no fixed version, so restrict access or change the code.
What's affected
74CMS 3.28.0, per the record's CPE data. The affected code is the sendCompanyLogo function in /controller/company/Index.php, part of the Company Logo Handler component, and the argument is imgBase64.
The NVD record scores it 6.3 (medium) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, published 2024-03-17. The weakness is classed as CWE-434 (unrestricted upload of a dangerous file type).
The record names no fixed version and I found no vendor patch in its references. Check the 74CMS project for a release newer than 3.28.0 and read its notes.
How to check if you're exposed
Confirm the version in your install. Then inspect the folder where company logos are stored and look for files that are not images:
find /var/www -path '*upload*' -type f ! -name '*.jpg' ! -name '*.png' ! -name '*.gif' 2>/dev/null
Any script file in an upload folder is a reason to start incident response.
What to do now
- Confirm the 74CMS version and check the project for a newer release.
- Check upload folders for files that are not images and review any you find.
- Stop the web server from executing scripts in upload directories.
- Limit the logo endpoint to signed-in company accounts and add size limits.
- Change the handler to check the decoded content type and rename files on save.
Why it matters
The weakness is unrestricted upload of a file with a dangerous type. The server accepts a file or encoded file body and stores it without enough checks on its type, name or location. If the upload folder is served by the web server and can run scripts, a stored file may turn into code execution. Even when it cannot run, it can fill disks or host content under your domain.
Good handling means an allow list of extensions and content types, generated file names, storage outside the web root, no execute rights on the upload folder, and authentication on the endpoint.
This CVE is not on the CISA Known Exploited Vulnerabilities list (the record's KEV flag is false). Exploit details are not repeated here, because this guide is about defence.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan lists the open source packages in a project and flags known vulnerabilities, and the Gold directory tracks this CVE. Reachability analysis helps decide which findings in your own code actually matter.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why does the base64 argument matter?
The logo arrives as an encoded string, so the server must decode it and verify the real file type. If it trusts the claimed type, a non-image can be stored.
Sources
Last reviewed: 19 October 2026.
