CVE-2024-11314

9.8 criticalEPSS 1.4%

Critical (9.8) in trcore dvc. EPSS 1.4% chance of exploitation in the next 30 days.

The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to upload arbitrary files to any directory, leading to arbitrary code execution by uploading webshells.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.4% chance of exploitation in the next 30 days; higher than 72% of CVEs (scores of 2026-10-31)
CWEs: CWE-22, CWE-434, CWE-23
Published: 2024-11-18
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

trcore:dvc

References

https://www.twcert.org.tw/en/cp-139-8253-bc363-2.html
https://www.twcert.org.tw/tw/cp-132-8252-91d6a-1.html

Check your stack JSON