CVE-2024-25859: Phillipsdata Blesta

High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days.

A path traversal vulnerability in the /path/to/uploads/ directory of Blesta before v5.9.2 allows attackers to takeover user accounts and execute arbitrary code.

Affected products

• Phillipsdata Blesta: before 5.9.2 (fixed in 5.9.2)

Published 2024-02-28. Last modified 2026-06-17.