{"vulnerability": "CVE-2026-24479", "sightings": [{"uuid": "59d4d191-2583-4d14-9dcf-cf629610e882", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24479", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mdetxesql32i", "content": "", "creation_timestamp": "2026-01-27T03:47:15.701831Z"}, {"uuid": "b0e13ce3-ee8c-4fd1-bbd9-fc4b07265ace", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24479", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/hustoj_problem_import_rce.rb", "content": "{\"aliases\": [], \"arch\": \"x64\", \"author\": [\"oxagast\", \"LoTuS and friends\", \"ling101w\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"A user with administrative privileges can abuse the problem_import_qduoj.php CGI script\\nusing a crafted zip file (zip-slip) to traverse backwards through the filesystem, then to the\\nwebroot, where they can extract a PHP file that spawns a shell to get full RCE in the\\ncontext of the webserver.\", \"disclosure_date\": \"2026-01-26\", \"fullname\": \"exploit/linux/http/hustoj_problem_import_rce\", \"is_install_path\": true, \"mod_time\": \"2026-06-02 10:32:30 +0000\", \"name\": \"HUSTOJ Admin users can zip-slip problem_import_qduoj.php, planting PHP files in webroot for RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/hustoj_problem_import_rce.rb\", \"platform\": \"Linux\", \"post_auth\": true, \"rank\": 500, \"ref_name\": \"linux/http/hustoj_problem_import_rce\", \"references\": [\"URL-https://github.com/oxagast/oxasploits/blob/JoshuaJohnWard/exploits/CVE-2026-24479/hustoj_problem_import_rce.rb\", \"URL-https://github.com/zhblue/hustoj/commit/902bd09e6d0011fe89cd84d4236899314b33101f\", \"URL-https://github.com/zhblue/hustoj/security/advisories/GHSA-xmgg-2rw4-7fxj\", \"CVE-2026-24479\", \"EDB-52539\", \"CWE-22\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Auto\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:37.751142Z"}]}