CVE-2026-24897: Erugo File-Sharing Platform RCE Vulnerability

CVE-2026-24897 Overview

CVE-2026-24897 is a critical path traversal vulnerability affecting Erugo, a self-hosted file-sharing platform. In versions up to and including 0.2.14, an authenticated low-privileged user can upload arbitrary files to any specified location due to insufficient validation of user-supplied paths when creating shares. By specifying a writable path within the public web root, an attacker can upload and execute arbitrary code on the server, resulting in remote code execution (RCE).

Critical Impact

This vulnerability allows a low-privileged authenticated user to fully compromise the affected Erugo instance through arbitrary file upload and remote code execution.

Affected Products

• Erugo versions up to and including 0.2.14
• Self-hosted Erugo deployments with authenticated user access
• Installations where authenticated users can create file shares

Discovery Timeline

• 2026-01-28 - CVE-2026-24897 published to NVD
• 2026-01-29 - Last updated in NVD database
• 2026-01-29 - Erugo releases version 0.2.15 with security fix

Technical Details for CVE-2026-24897

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Path Traversal), which occurs when user-supplied input containing path traversal sequences is not properly sanitized before being used in file system operations. The flaw exists in the share creation functionality of Erugo, where the application fails to adequately validate the destination path specified by users.

When an authenticated user creates a share, they can provide a path that includes directory traversal sequences (such as ../) or absolute paths. Due to insufficient validation, the application accepts these manipulated paths and writes uploaded files to attacker-controlled locations on the file system.

The attack becomes particularly severe when an attacker targets the public web root directory. By uploading a malicious script (such as a PHP webshell) to a web-accessible location, the attacker can then execute arbitrary code on the server by requesting the uploaded file through the web server.

Root Cause

The root cause of this vulnerability lies in the insufficient validation of user-supplied paths within the share creation functionality. The application does not properly canonicalize or sanitize the destination path before using it in file write operations. This allows attackers to escape intended directory boundaries using path traversal techniques, effectively bypassing the application's intended access controls and file storage restrictions.

Attack Vector

The attack vector for CVE-2026-24897 involves the following sequence:

1. An attacker authenticates to the Erugo application with a low-privileged user account
2. The attacker initiates a share creation request with a manipulated destination path containing directory traversal sequences
3. The application fails to validate the path and accepts the malicious input
4. The attacker uploads a malicious file (such as a PHP webshell) through the created share
5. The file is written to a web-accessible directory on the server
6. The attacker accesses the uploaded file through a web request, triggering code execution

The exploitation requires authentication but only minimal privileges. The vulnerability is exploitable over the network without user interaction, and successful exploitation leads to complete server compromise with potential impacts to confidentiality, integrity, and availability of the system.

Detection Methods for CVE-2026-24897

Indicators of Compromise

• Unexpected files appearing in web root directories, particularly script files (.php, .phtml, .asp, etc.)
• Web server access logs showing requests to unfamiliar or suspicious script files
• Share creation activities with unusual destination paths containing ../ sequences or absolute paths
• Anomalous outbound network connections originating from the web server process

Detection Strategies

• Monitor file system activity for write operations to web-accessible directories outside the intended upload paths
• Implement web application firewall (WAF) rules to detect path traversal patterns in HTTP requests
• Review application logs for share creation requests with suspicious path parameters
• Deploy file integrity monitoring (FIM) on web root directories to detect unauthorized file additions

Monitoring Recommendations

• Enable detailed logging for the Erugo application, particularly for share creation and file upload activities
• Configure alerts for new file creation events in sensitive directories such as the web root
• Monitor for execution of newly created script files that were not part of legitimate application deployments
• Implement network monitoring to detect command-and-control traffic that may result from successful exploitation

How to Mitigate CVE-2026-24897

Immediate Actions Required

• Upgrade Erugo to version 0.2.15 or later immediately, as this version contains the security fix
• Audit existing shares for any that may have been created with malicious destination paths
• Scan web root directories for unauthorized or suspicious files that may have been uploaded
• Review user accounts and remove or disable any that are unnecessary to reduce attack surface

Patch Information

The vulnerability has been fixed in Erugo version 0.2.15. The security fix is documented in the GitHub Security Advisory GHSA-336w-hgpq-6369. The specific code changes can be reviewed in commit 256bc63831a0b5e9a94cb024a0724e0cd5fa5e38. The updated release is available at the Erugo v0.2.15 release page.

Workarounds

• If immediate patching is not possible, restrict network access to the Erugo application to trusted users only
• Implement additional access controls at the web server level to prevent execution of files in upload directories
• Configure the web server to serve static content only from upload directories, disabling script execution
• Monitor and audit all share creation activities manually until the patch can be applied

# Example: Disable PHP execution in uploads directory (Apache)
# Add to .htaccess in the uploads directory
# php_flag engine off

# Example: Disable PHP execution in uploads directory (Nginx)
# Add to server block configuration
# location /uploads {
#     location ~ \.php$ { deny all; }
# }