CVE-2024-53636 is a medium severity (CVSS 6.4) arbitrary file upload flaw in writefile.php of Serosoft Academia Student Information System EagleR-1.0.118. The record says a path sequence in the filePath parameter allows code execution. No fixed version is listed, so ask the vendor and limit access.
What's affected
The record names Serosoft Academia Student Information System (SIS) EagleR-1.0.118, listed in the NVD product data as academiaerp student_information_system. The vulnerable file is writefile.php, and the parameter is filePath.
The record does not list a fixed version. The researcher repositories referenced in the record could not be retrieved during review, so this post uses only what the NVD description says.
Student information systems hold records about minors and staff, so even a medium score deserves attention when the application is exposed to the internet.
How to check if you're exposed
If you run this product, ask your vendor which build you are on and whether it is EagleR-1.0.118. Check that the writefile.php page exists and who can reach it.
find /var/www -name "writefile.php" 2>/dev/null
Review the web server logs for requests to that file, with attention to unusual values in filePath. Check upload and web directories for files with executable extensions that were not placed by your team.
What to do now
- Confirm with the vendor whether your build is affected and when a fix will ship.
- Restrict the application to your network or a VPN until the fix is installed.
- Block write access for the web server account outside the intended upload folder.
- Make sure the web server does not execute scripts from upload directories.
- Review the web directory and logs for files and requests you do not recognise.
Why it matters
The record classes the weakness as CWE-24 (Path Traversal (filedir/..)). The application takes a file path from the request and writes data to it without limiting the path to a safe folder, so a path with parent directory sequences can step outside. Combined with an upload that accepts any content, the attacker can place a file where the server will run it, which is how the description reaches code execution.
The CVSS vector in the record rates the score as medium because privileges are required. That is a reason to check who holds accounts, not to ignore the finding. The record does not flag exploitation, and the CVE is not on the KEV list. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that you can use to check manifests for known CVEs, and the Gold directory lists this one at https://gold.safeguard.sh/vulnerability/CVE-2024-53636.
Quick check
Is there a fixed version of Serosoft Academia SIS?
The record lists none, so ask the vendor.
Does the attacker need an account?
The medium score reflects that privileges are required, according to the CVSS vector in the record.
Sources
- Researcher repository (listed in the NVD record, not retrievable during review)
- Gold entry for CVE-2024-53636
Last reviewed: 19 October 2026.
