CVE-2024-39752 is a medium severity (CVSS 6.8) file upload flaw in IBM Analytics Content Hub 2.0, 2.1, 2.2 and 2.3. The Explore Content feature does not validate the type of uploaded files, so malicious executables can be stored and sent to victims. IBM's fix is IBM Cognos Analytics Content Hub 2.4.
What's affected
Per IBM's security bulletin, published July 9, 2025:
- IBM Analytics Content Hub 2.0 through 2.3: affected.
- Fix: IBM Cognos Analytics Content Hub 2.4.
- Workarounds and mitigations: none listed.
The flaw is in the Explore Content upload path. The bulletin also covers a second issue for the same product, an exposed JavaScript source map, and the same upgrade resolves both.
How to check if you're exposed
Open the product's about or administration page and read the version. For the Content Hub, compare it with 2.0 to 2.3 and confirm you are on 2.4 or later after the fix.
Review the files already stored through Explore Content. Look for executable types and scripts that users should not be uploading, and check who uploaded them and when.
What to do now
- Upgrade to IBM Cognos Analytics Content Hub 2.4 following IBM's steps.
- Audit the existing uploads for executable or script files and remove any that should not be there.
- Limit who may upload content, and scan uploads with your endpoint tools before users download them.
- Warn staff not to open unexpected files shared from the platform until the upgrade is done.
Why it matters
The class is CWE-434, unrestricted upload of a dangerous file type. The server accepts whatever a user sends. The danger here is mostly social: a malicious file placed on a trusted internal platform is more likely to be opened than one from email.
The vector needs high privileges and user interaction, so a stranger on the internet cannot do this alone. A compromised or malicious insider account can. The defence is the usual set: an allowlist of file types checked on the server, content scanning, and storing uploads where they cannot be run.
For your own applications, the same lesson applies to any upload feature. Check the type of each file by content, not by name. Store uploads outside the web root, serve them with a safe content type, and scan them before other users can fetch them. Until the upgrade is done, a short note to users about opening files from the platform costs nothing and closes the social side of the risk.
Quick check
Does an attacker need an account?
The vector lists high privileges required, so the attacker needs an account that can use Explore Content, plus a victim who opens the file.
Sources
Last reviewed: 19 October 2026.
