CVE-2024-0649

CRITICAL 9.8CVE-2024-0649 · Published 17/01/2024 · updated 17/06/2026

In short

CVE-2024-0649 is a CRITICAL (CVSS 9.8) vulnerability affecting zhihuiyun (zhiyun-tech).
Chance of exploitation in the next 30 days (EPSS): 0.49%, higher than 42.6% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
zhihuiyun zhiyun-tech	`≤ 4.4.13`	No fix yet

Description

A vulnerability was found in ZhiHuiYun up to 4.4.13 and classified as critical. This issue affects the function download_network_image of the file /app/Http/Controllers/ImageController.php of the component Search. The manipulation of the argument url leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-251375.

References

note.zhaoj.in/share/jC6NMe5TRSys · Broken Link
vuldb.com · Permissions Required
vuldb.com · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free