Cleo Multiple Products Unrestricted File Upload Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 13/12/2024. Patch affected systems as an emergency. It is known to be used in ransomware campaigns.
| Package | Affected versions | Patched versions |
|---|---|---|
| harmony | < 5.8.0.21 | 5.8.0.21 |
| lexicom | < 5.8.0.21 | 5.8.0.21 |
| vltrader | < 5.8.0.21 | 5.8.0.21 |
In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free