CVE-2024-33120

Critical · CVSS 9.8

Roothub — Arbitrary File Upload leading to Remote Code Execution (RCE)

CVSS: 9.8; nvd
EPSS: —
KEV: No
Class: other; CWE-434

Description

Roothub v2.5 was discovered to contain an arbitrary file upload vulnerability via the customPath parameter in the upload() function. This vulnerability allows attackers to execute arbitrary code via a crafted JSP file.

Search profile — drives PoC discovery

Symbols customPathupload()JSP file uploadcustomPath parameter

Keywords CVE-2024-33120Roothubarbitrary file uploadcustomPathupload functionJSP webshellRoothub v2.5CWE-434unrestricted file upload

Versions: v2.5

Ranked PoCs (1) — best first

Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.

fkie-cad/nvd-json-data-feeds needs review

trickest

★ 0

Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.

References

Status: enriched · ingested 2026-07-05T06:00:39.000Z · profiled 2026-07-06T00:30:39.000Z