CVE-2024-39171

Critical · CVSS 9.8

PHPVibe — Path Traversal / Directory Traversal leading to RCE via .htaccess and file upload bypass

CVSS: 9.8; nvd
EPSS: —
KEV: No
Class: oss containerizable; CWE-22, CWE-35

Description

Directory Travel in PHPVibe v11.0.46 due to incomplete blacklist checksums and directory checks, which can lead to code execution via writing specific statements to .htaccess and code to a file with a .png suffix.

Search profile — drives PoC discovery

Symbols .htaccess.pngblacklistdirectory checkfile uploadcode executionsuffix bypassv11.0.46

Keywords CVE-2024-39171PHPVibedirectory traversalpath traversalCWE-22CWE-35htaccess writepng suffix bypassblacklist bypassfile upload RCEPHPVibe v11.0.46PHPVibe vulnerability

Versions: v11.0.46

Ranked PoCs (2) — best first

Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.

751897386/PHPVibe_vulnerability_Directory-Traversal candidate

cited in references

trickest

★ 0
fkie-cad/nvd-json-data-feeds needs review

trickest

★ 0

Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.

References

Status: enriched · ingested 2026-07-05T06:00:39.000Z · profiled 2026-07-06T00:30:39.000Z