CVE-2024-48760: GestioIP unrestricted file upload enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with a 9.8 CVSS score, a public exploit reference, and very high EPSS probability make this an urgent patch target.

What it is

GestioIP v3.5.7 exposes a file upload function that does not restrict uploaded file types. An attacker can upload a malicious perlcmd.cgi that overwrites the original upload.cgi, turning the upload endpoint into a remote command execution primitive. The flaw is remotely reachable without authentication and carries a critical CVSS score of 9.8.

Impact

An attacker gains arbitrary command execution on the GestioIP host, which can lead to full compromise of the application and its data. Because the overwritten CGI is part of the web application, the attacker effectively controls the server process.

Attack surface

Reached over the network through the GestioIP web file upload function; the CVSS vector shows no privileges required and no user interaction, so the endpoint is directly reachable by an unauthenticated remote attacker.

Exploitation

Not listed in CISA KEV and no ransomware usage documented, but EPSS is 0.45109 (98.7th percentile) and a public exploit reference exists on GitHub, indicating meaningful real-world exploitation likelihood.

What to do

• Apply the vendor fix for GestioIP v3.5.7 or upgrade to a patched release as soon as one is available.
• Restrict or disable the file upload function until patching is possible, and block uploads of executable or CGI file types.
• Run GestioIP with least privilege and isolate it from sensitive internal networks.
• Add a web application firewall rule to block uploads of .cgi and other executable extensions to the upload endpoint.
• Monitor the GestioIP web root for unexpected changes to upload.cgi or newly created CGI files.

Detection

• Alert on POST requests to the GestioIP upload endpoint that carry .cgi or other executable file extensions.
• Monitor file integrity of the GestioIP web directory, especially upload.cgi and any newly written CGI files.
• Hunt for unexpected child processes spawned by the GestioIP web server user.
• Review web server logs for upload requests followed by requests to newly created or modified CGI paths.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.