CVE-2024-50623
Cleo Multiple Products Unrestricted File Upload Vulnerability
- Published
- Oct 27, 2024
- Updated
- Jul 31, 2026
- Assigning CNA
- mitre
- Evidence observed
- Dec 13, 2024
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HHigh · next 30 days
- Percentile
- 99.9%
- Model date
- Sep 21, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
CISA Known Exploited
This CVE appears in the CISA Known Exploited Vulnerabilities catalog.
Summary
In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.
Sources
5- CVE-2024-50623Exploit
CVE-2024-50623 POC - Cleo Unrestricted file upload and download
Cleo Unrestricted file upload and download PoC (CVE-2024-50623)
Proof-of-concept exploit for CVE-2024-50623 targeting web services on port 8983. Includes a Python script for automated exploitation and vulnerability verification.
- Cleo-CVE-2024-50623-PoCScanner
Cleo 远程代码执行漏洞批量检测脚本（CVE-2024-50623）
CVE proof-of-concept labs, exploit scripts, and detection/prevention rules (Nginx, Apache, Snort, YARA) for high-severity CVEs. Authorized security testing & research only.
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.