CVE-2024-2599 is a file upload restriction bypass in AMSS++ version 4.31 that could let an authenticated user obtain remote code execution through a webshell. Severity is Critical at 9.9. No fixed version is named in the record, so check the INCIBE notice and the vendor.
What's affected
- AMSS++ 4.31 is the only version the record lists.
- The attacker must be authenticated, which the CVSS vector reflects as low privileges required.
- No fixed version is named in the NVD record. Check the vendor or the advisory linked in Sources before assuming a patch exists.
The NVD record gives a CVSS score of 9.9 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Published 2024-03-18.
How to check if you're exposed
- Confirm whether AMSS++ is deployed and which version it reports.
- On the server, list files in the application's upload directories that have script extensions such as .php and were not placed there by your own deployment. A command such as
find /var/www -newer /path/to/last-known-good-deploy -name "*.php"is a start; adapt paths to your layout. - Review which accounts can reach the upload function and whether any are shared or unused.
- Read the INCIBE notice named in Sources for more detail.
What to do now
- Inventory every AMSS++ instance and note the version.
- Check the INCIBE notice and the vendor for a patched release, and apply it when one is confirmed.
- Restrict the application to trusted networks, and remove accounts that do not need upload rights.
- Make the upload directory non-executable at the web server level, so uploaded files cannot run as scripts.
- Hunt for unexpected script files in writable directories and treat any as an incident.
If this software reaches you as part of something you build, the free in-browser dependency scan at gold.safeguard.sh/scan lists known vulnerabilities in your manifests, and reachability analysis helps you see which ones your code can actually trigger.
Why it matters
The record describes an upload restriction evasion. The score of 9.9 is high partly because the scope is changed: a compromise of the application can reach beyond it, and the record says the entire infrastructure could be compromised. The attacker needs a login, but in many deployments accounts are easy to obtain or share.
The record tags the weakness as CWE-434. See the Gold pages for more on the class.
Unrestricted upload bugs appear when an application accepts a file without properly checking its type, name and destination. If the file lands somewhere the web server will execute it, an upload feature becomes a way to run code. Safe designs store uploads outside the web root, rename them, and check content rather than trusting the file extension.
The record's Known Exploited Vulnerabilities flag is false, so CISA has not listed it as exploited.
This flaw was published together with three SQL injection flaws in the same product version, CVE-2024-2590, CVE-2024-2591 and CVE-2024-2592. Fixing one issue does not remove the others, so review the whole product rather than a single endpoint.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does the attacker need an account?
Yes. The record says an authenticated user could exploit it, and the CVSS vector lists low privileges required. That still counts as serious, because accounts are often easy to get.
Sources
I did not retrieve the pages above when preparing this post, either because they blocked automated access or because I relied on the NVD record. The details here come from that record, so read the linked reference for the original wording.
Last reviewed: 19 October 2026.
