CVE-2024-44849: Qualitor checkAcesso.php unrestricted file upload enables RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

critical priorityUnauthenticated network-reachable remote code execution with a CVSS score of 9.8 and public exploit references warrants critical priority despite the absence of KEV listing.

What it is

Qualitor up to 8.24 exposes checkAcesso.php, which accepts file uploads without adequate validation, allowing an attacker to place executable content on the server. Because the uploaded file can be executed, this is a full remote code execution flaw rather than a simple file-write issue. The vendor has published a security advisory, so a fixed release is expected to exist, though the record does not state which version contains the fix.

Impact

An unauthenticated attacker can run arbitrary code on the Qualitor server, leading to full compromise of confidentiality, integrity and availability of the application and its data.

Attack surface

The flaw is reachable over the network through checkAcesso.php with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any internet- or network-exposed Qualitor instance up to 8.24 is in scope.

Exploitation

CVE-2024-44849 is not listed in CISA KEV, but public exploit material exists: a third-party advisory and a GitHub repository are tagged as exploit references. EPSS gives a 30-day exploitation probability of roughly 46 percent (98.8th percentile), indicating high near-term likelihood.

What to do

• Apply the vendor fix from the official Qualitor security advisory for CVE-2024-44849; confirm the patched version with the vendor since the record does not name it.
• If patching cannot be done immediately, restrict network access to checkAcesso.php and the Qualitor application to trusted sources only.
• Disable or block execution of uploaded files in the web-accessible upload directory (for example, deny script execution there).
• Add server-side validation of file type, extension and content for all upload endpoints, not just checkAcesso.php.
• Review server and application logs for unexpected files written by the web user and remove any found.

Detection

• Monitor web server and application logs for POST requests to checkAcesso.php, especially from unfamiliar source IPs.
• Alert on new files appearing in web-accessible upload directories, particularly files with executable extensions such as .php, .jsp or .aspx.
• Watch for child processes spawned by the web server user (for example, shell or scripting interpreter processes) as a sign of uploaded code execution.
• Baseline and diff the Qualitor web root for unexpected file additions or modifications.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.