CVE-2024-36858

Published: Jun 4, 2024
Updated: May 4, 2025
CVE: <a href="https://nvd.nist.gov/vuln/detail/CVE-2024-36858" target="_blank" rel="noopener"> CVE-2024-36858
GHSA: <a href="https://github.com/advisories/GHSA-qfjh-mvq6-c5p8" target="_blank" rel="noopener"> GHSA-qfjh-mvq6-c5p8
Severity: Critical
Exploit:

An arbitrary file upload vulnerability in the /v1/app/writeFileSync interface of Jan v0.4.12 allows attackers to execute arbitrary code via uploading a crafted file.