CVE-2024-0352: Likeshop FileServer::userFormImage unrestricted file upload

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication, no user interaction, and public exploit disclosure make this a critical risk.

What it is

Likeshop up to 2.5.7.20210311 contains an unrestricted file upload in FileServer::userFormImage in server/application/api/controller/File.php, reachable via HTTP POST. The file argument is not properly validated, allowing an attacker to upload arbitrary files. Because the endpoint is remotely reachable without authentication, this is a critical risk for code execution or server compromise.

Impact

An attacker can upload arbitrary files, including executable scripts, to the server. Successful exploitation can lead to remote code execution, full server compromise, and data theft or modification.

Attack surface

The flaw is reached over the network via an HTTP POST request to the File API endpoint handling userFormImage. The CVSS vector indicates no authentication (PR:N) and no user interaction (UI:N) are required.

Exploitation

The description states the exploit has been disclosed publicly and may be used. CISA KEV does not list this CVE, but EPSS is very high at 0.72917 (99.4th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Apply the vendor patch or upgrade Likeshop beyond 2.5.7.20210311 if an official fix is available.
• Restrict upload handling to allowlisted file types and validate file content, not just extensions.
• Disable execution of uploaded files by storing them outside the web root or configuring the web server to deny script execution in upload directories.
• Require authentication and authorization for the File API endpoint if it is not intended to be public.
• Monitor and block POST requests to the vulnerable File.php endpoint until patching is complete.

Detection

• Search web server logs for POST requests to server/application/api/controller/File.php or the userFormImage action, especially with multipart/form-data uploads.
• Monitor upload directories for newly created executable files (e.g., .php, .phtml, .jsp) and alert on unexpected file types.
• Use file integrity monitoring to detect new or modified files in web-accessible directories.
• Inspect HTTP traffic for anomalous file uploads with suspicious filenames or content types.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.