CVE-2024-11315

The vulnerability results from two related weaknesses: lack of proper path validation during file uploads (path traversal, CWE-22/CWE-23) and lack of restrictions on accepted file types (CWE-434). An unauthenticated attacker can send an HTTP request containing a malicious file (e.g., PHP/ASP webshell) with a manipulated target path. Through path traversal, the file is placed outside the intended directory — directly into a location accessible by the web server. After placing the webshell on the server, the attacker can invoke it through a browser and execute arbitrary system commands.

An attacker gains the ability to execute arbitrary code on the server (RCE) with the privileges of the web server process, which may result in complete system takeover, data theft, and further lateral movement in the network.

Apply patches available from the vendor in accordance with references published by TWCERT/CC (https://www.twcert.org.tw/en/cp-139-8255-0bb1a-2.html). Until updates are applied, consider disabling file upload functionality or restricting application access exclusively to trusted networks.

TRCore's DVC product — specific versions indicated in vendor references (TWCERT/CC).