CVE-2024-42180 is a low severity (CVSS 1.6) vulnerability in HCL MyXalytics. The application accepts invalid file uploads, including wrong content types, double extensions, null bytes and special characters, which could let attackers upload and run malicious files. The record gives no fixed version, so read HCL's knowledge base article KB0118149 and apply the update it names.
What's affected
The NVD record names HCL MyXalytics as the affected product. It does not list version numbers or fixed versions.
HCL publishes the details in knowledge base article KB0118149. When I fetched that page, it rendered only a loading message, so I could not read the affected and fixed versions. Open the article in a browser with your HCL support login if needed, and take the version list from there.
The same HCL article covers several HCL MyXalytics CVEs published together, so one update pass may close more than one.
How to check if you're exposed
Find out whether you run HCL MyXalytics at all. Ask the team that owns collaboration, analytics or cloud tools, because these products are often installed by a business unit.
Then read the version from the product's about or admin page, and compare it with the affected and fixed versions in article KB0118149.
If the article is hard to reach, open a case with HCL support and ask for the fixed version in writing.
What to do now
- Read HCL article KB0118149 and write down the affected and fixed versions.
- Update to the fixed version the article names.
- Apply the update with the other MyXalytics fixes in the same article.
- Review the upload folder for files with double extensions or unusual names.
- Confirm the web server does not execute files from the upload location.
Why it matters
The class is CWE-434, unrestricted upload of a dangerous file type. The record lists several tricks that weak upload checks miss: a wrong content type header, a double extension, a null byte and special characters in the file name. A good upload handler rejects all of them.
The score is only 1.6 because the vector requires physical access, high privileges and user interaction. That is a narrow path. The description still says uploaded files could be executed, so the fix is worth applying. For your own applications, check uploads by content, rename them on the server, and store them where the web server will not run them.
A note on vendor articles. Some support portals load their content with scripts, so a plain page fetch or a text-only reader shows nothing. If you track advisories with an automated tool, check that it can read the articles you depend on, or you may miss the fixed version. Keep a record of the article number, the date you read it and the version you chose, so the audit trail is clear if someone asks later.
Quick check
Why is the score so low if files can be executed?
The vector requires physical access, high privileges and user interaction, which narrows who can use it. The weakness is still worth fixing.
Sources
Last reviewed: 19 October 2026.
