CVE-2024-2849 is a Medium severity (CVSS 6.3) unrestricted file upload flaw in SourceCodester Simple File Manager 1.0, through the photo argument. The exploit is publicly disclosed and no fixed version is listed. Take the application off the internet or restrict access.
What's affected
- Product: SourceCodester Simple File Manager 1.0 (CPE vendor ganeshrkt).
- Affected: 1.0.
- Fixed: none listed.
- Weakness: CWE-434.
- Access needed: a low privilege account over the network (CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
The record says the code location is unknown, and that manipulating photo leads to unrestricted upload. VulDB tracks it as VDB-257770.
Severity note: VulDB calls it critical, the CVSS score is 6.3 (Medium). Both are in the record.
How to check if you're exposed
This is a PHP sample application, so look at your servers rather than a package manifest.
- Search for it:
grep -ril "simple file manager" /var/www(adjust the path). - Confirm whether the version is 1.0.
- Test whether it is reachable from outside your network.
- Inspect upload folders for script files such as php that nobody placed on purpose.
What to do now
- Find every copy of the application.
- Put it behind authentication or a VPN, or remove it.
- Disable script execution in upload directories at the web server.
- Allow only the file types you need and rename uploaded files.
- Review the upload folder for unexpected files.
Why it matters
Unrestricted file upload means an application accepts a file without checking its type, name or destination well enough. If the uploaded file lands somewhere the server will execute or serve it, the upload becomes a way to run attacker chosen content.
The record scores this lower because the CVSS vector requires elevated privileges, but admin panels get compromised through other routes all the time, and a privileged upload flaw then turns a foothold into code execution.
The record gives few details, so the practical lesson is general: upload handlers need a type allow list, safe storage outside the web root, and no execute permission. A code scan of the source would show whether the handler checks types at all.
KEV status: the record has the CISA Known Exploited Vulnerabilities flag set to false, and none of the sources we could read says this is exploited in the wild. That can change, so watch for updates.
Try it yourself
Upload handlers are a good fit for static analysis of source. The code scan demo shows what that looks like.
Click through it at your own pace, or open it full screen.
Quick check
Is there a fix?
The record lists none. Check the project page.
What should uploads never do?
Land in a folder where the server will run them as code.
Sources
Record references (not all retrievable when we reviewed this post):
- https://github.com/CveSecLook/cve/issues/1
- https://vuldb.com/?ctiid.257770
- https://vuldb.com/?id.257770
- https://vuldb.com/?submit.303123
Last reviewed: 19 October 2026.
