CVE-2024-3227 is a medium severity (CVSS 4.7) path traversal in Panwei (Weaver) eoffice OA up to version 9.5, in the theme image save handler of the backend. The record names no fixed version, so contact the vendor, restrict access to the backend, and review file permissions.
What's affected
Panwei eoffice OA up to and including 9.5. The affected file is /general/system/interface/theme_set/save_image.php in the backend, and the image_type argument is the manipulated input. The record says the attack can be started remotely and that an exploit is public.
No fixed version or vendor advisory is listed in the record, and the supporting links (a GitHub write up and VulDB) were not reviewed. Do not assume a later release is fixed. Ask the vendor or reseller directly.
The score is medium because the attack needs privileges and has high complexity in the vector.
The weakness class: CWE-24, path traversal of the form ../filedir. The NVD record scores it 4.7 (medium) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L. CISA Known Exploited Vulnerabilities status in the record: not listed.
Source note: the description says classified as critical (VulDB wording) while NVD scores it 4.7, Medium.
How to check if you're exposed
Find your product version in the application's about page or admin settings. If it is 9.5 or earlier, treat it as affected. Then check whether the backend path is reachable from the internet, for example with a request from outside your network to the login page, and look in the web logs for requests to the save_image.php handler from unexpected addresses.
What to do now
- Confirm your eoffice version and compare with 9.5.
- Contact the vendor for a patch or a mitigation statement and keep the reply on file.
- Restrict the backend to internal networks or a VPN.
- Check that the web server account cannot write outside the theme directory.
- Review logs for unusual requests to the handler.
Why it matters
CWE-24, path traversal of the form ../filedir, means file path input is not cleaned of parent directory references. Depending on permissions, that can allow files to be written or read outside the intended location.
Collaboration and office automation systems hold sensitive documents and are often exposed for remote staff. Without a published fix, network restrictions and file system permissions carry the weight.
Quick check
What do I do when the vendor has not published a fix?
Reduce exposure first: limit who can reach the backend, tighten file permissions, and monitor logs. Then ask the vendor for a patch or a written mitigation, and set a date to revisit or replace the product.
Sources
- References in the NVD record (not individually reviewed): a GitHub write up and VulDB entry 259072
- Safeguard Gold entry for CVE-2024-3227
- Free in-browser dependency scan
Last reviewed: 19 October 2026.
