An arbitrary file upload vulnerability in the image upload function of Automad v2.0.0 allows attackers to execute arbitrary code via a crafted file.

The malicious file has to be prepared and uploaded manually by the admin. Usually there is only one admin per site and that is the owner.

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-40400
• marcantondahmen/automad#106
• marcantondahmen/automad@112f070