CVE-2024-2565 is a medium severity (CVSS 6.3) unrestricted upload in PandaX up to the 20240310 build. The file extension handler in upload.go accepts the file argument without limiting types. The record names no fixed release, so check the project. The sections below cover how to check your exposure and what to do.
What's affected
PandaX up to 20240310, per the record. The affected component is the File Extension Handler in /apps/system/router/upload.go and the argument is file. The record links an issue in the project and names no release.
The NVD record scores it 6.3 (medium) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, published 2024-03-17. The weakness is classed as CWE-434 (unrestricted upload of a dangerous file type).
The record names no fixed release. Check the PandaXGO commits after 10 March 2024 for a change to the upload handler.
How to check if you're exposed
Check your build's commit date and read the handler:
git log -1 --format=%cd
grep -n "ext" apps/system/router/upload.go
Then inspect the upload folder for any file that is not an image or expected document type.
What to do now
- Check the commit date of your PandaX build.
- Inspect the upload folder for unexpected file types.
- Update to a build with a fix, or add an allow list of extensions and content types.
- Serve uploads from a separate origin with no script execution.
- Require authentication on the upload route.
Why it matters
The weakness is unrestricted upload of a file with a dangerous type. The server accepts a file or encoded file body and stores it without enough checks on its type, name or location. If the upload folder is served by the web server and can run scripts, a stored file may turn into code execution. Even when it cannot run, it can fill disks or host content under your domain.
Good handling means an allow list of extensions and content types, generated file names, storage outside the web root, no execute rights on the upload folder, and authentication on the endpoint.
This CVE is not on the CISA Known Exploited Vulnerabilities list (the record's KEV flag is false). Exploit details are not repeated here, because this guide is about defence.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan lists the open source packages in a project and flags known vulnerabilities, and the Gold directory tracks this CVE. Reachability analysis helps decide which findings in your own code actually matter.
Quick check
What should an upload handler check?
An allow list of extensions, the real content type, size limits and a server generated file name, with storage outside the code path.
Sources
Last reviewed: 19 October 2026.
