CVE-2024-2604 is an unrestricted file upload in SourceCodester File Manager App 1.0, in the file /endpoint/update-file.php through the file argument. Severity is Medium at 6.3. No fixed version is named in the record, so treat the application as unpatched. The sections below cover affected versions, checks and next steps.
What's affected
- SourceCodester File Manager App 1.0 is the only version listed.
- The affected file is /endpoint/update-file.php and the argument is file.
- The record states that the exploit has been disclosed to the public and may be used. It does not say it was used in attacks, and CISA's KEV list does not include it.
- No fixed version is named in the NVD record. Check the vendor or the advisory linked in Sources before assuming a patch exists.
The NVD record gives a CVSS score of 6.3 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. Published 2024-03-18.
How to check if you're exposed
- Find out whether the application is installed on any server. These sample PHP projects are often downloaded for learning and left running.
- List files in the upload directories that have script extensions:
find /var/www -name "*.php" -path "*upload*"is a starting point, adjusted to your paths. - Search web logs for requests to update-file.php.
- Check the VulDB entry VDB-257182 named in the record for the reference trail.
What to do now
- Take the application off any public network, or put it behind authentication at the web server.
- If you must keep it, add server side checks: allow only expected file types, rename uploads and store them outside the web root.
- Configure the web server so the upload directory cannot execute scripts.
- Review the upload directory for unexpected files, and treat any script file as a sign of compromise.
- Prefer a maintained application over a sample project for anything real.
If this software reaches you as part of something you build, the free in-browser dependency scan at gold.safeguard.sh/scan lists known vulnerabilities in your manifests, and reachability analysis helps you see which ones your code can actually trigger.
Why it matters
The cause is an upload handler that does not limit what kind of file it accepts. The score of 6.3 is medium because the vector shows low privileges required and limited impact on each of confidentiality, integrity and availability. In practice an upload flaw can be worse than the score suggests when the file lands in a folder that runs scripts, so the server configuration matters as much as the code.
The record tags the weakness as CWE-434. See the Gold pages for more on the class.
Unrestricted upload bugs appear when an application accepts a file without properly checking its type, name and destination. If the file lands somewhere the web server will execute it, an upload feature becomes a way to run code. Safe designs store uploads outside the web root, rename them, and check content rather than trusting the file extension.
The record's Known Exploited Vulnerabilities flag is false, so CISA has not listed it as exploited.
Projects like this are published as teaching samples. They usually lack the input checks a production application needs, so a single reported flaw is rarely the only one.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is this being exploited in the wild?
The record says the exploit has been disclosed publicly and may be used, but the KEV flag is false and no advisory I fetched reports exploitation in attacks.
Sources
I did not retrieve the pages above when preparing this post, either because they blocked automated access or because I relied on the NVD record. The details here come from that record, so read the linked reference for the original wording.
Last reviewed: 19 October 2026.
