Description
An arbitrary file upload vulnerability in the Image Gallery of ThingsBoard Community, ThingsBoard Cloud and ThingsBoard Professional v3.8.1 allows attackers to execute arbitrary code via uploading a crafted file.
Exploits (1)
nomisec
WRITEUP
by cybsecsid · poc
https://github.com/cybsecsid/ThingsBoard-IoT-Platform-CVE-2024-55466
Scores
CVSS v3
6.5
EPSS
0.0044
EPSS Percentile
63.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-77
Status
published
Products (1)
thingsboard/thingsboard
< 3.8.1
Published
May 12, 2025
Tracked Since
Feb 18, 2026