CVE-2024-55466

6.5 mediumEPSS 0.4%

Medium (6.5) in thingsboard thingsboard. EPSS 0.4% chance of exploitation in the next 30 days.

An arbitrary file upload vulnerability in the Image Gallery of ThingsBoard Community, ThingsBoard Cloud and ThingsBoard Professional v3.8.1 allows attackers to execute arbitrary code via uploading a crafted file.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 33% of CVEs (scores of 2026-10-31)
CWE: CWE-77
Published: 2025-05-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

thingsboard:thingsboard

References

https://github.com/cybsecsid/ThingsBoard-IoT-Platform-CVE-2024-55466
https://github.com/thingsboard/thingsboard/releases/tag/v3.8.1

Check your stack JSON