CVE-2024-58281: Dotclear

High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days.

Dotclear 2.29 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the media upload functionality. Attackers can exploit the file upload process by crafting a PHP shell with a command execution form to gain system access through the uploaded file.

Affected products

• Dotclear Dotclear: version 2.29 only

Published 2025-12-10. Last modified 2026-09-26.