CVE-2026-24729: Interinfo DreamMaker Unrestricted File Upload Vulnerability
CVE-2026-24729 affects the file upload function of Interinfo DreamMaker in versions before 2025/10/22, as described by the CNA ART@zuso.ai. The weakness is classified as CWE-434, and the CNA assigns a CVSS 4.0 base score of 10, which is critical. The record lists no affected or fixed version ranges, and no confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-24729 is an unrestricted upload of file with dangerous type weakness (CWE-434) in the file upload function of Interinfo DreamMaker. The record was published on 2026-01-30 by the CNA ART@zuso.ai. The CNA has issued an advisory, available at zuso.ai advisory ZA-2026-02.
Impact
- According to the record, remote attackers can execute arbitrary system commands by supplying a malicious class file.
- The CNA assigns a CVSS 4.0 base score of 10 with high impact on confidentiality, integrity and availability, and no privileges or user interaction required.
- Inference: a network-reachable flaw of this kind, if present in an exposed instance, would represent a severe risk to the confidentiality, integrity and availability of the host.
Affected products and versions
- Product: Interinfo DreamMaker.
- Affected range as described: versions before 2025/10/22.
- The record contains no structured list of affected or fixed versions, so the exact impacted builds are unknown.
- Inference: releases dated 2025/10/22 or later appear to fall outside the stated range, but this should be confirmed with the vendor or the CNA advisory.
Exploitation status
- The record shows that the vulnerability is not listed in the CISA KEV catalog.
- No confirmed active exploitation appears in the sources consulted.
- No EPSS or SSVC data is present in the record.
Remediation and mitigation
- Inventory all DreamMaker installations and record their versions and build dates.
- Check the CNA advisory and any vendor communication for a fixed release, and apply it as soon as it is validated.
- Restrict the upload function to authenticated and trusted users, and limit its network exposure.
- Validate uploaded file types against a strict allowlist, store uploads outside directories that the web server can execute, and disable execution rights on upload storage.
- Review existing upload content for unexpected class or executable artifacts.
Detection guidance
- Monitor upload directories for new files with unexpected types, especially executable or class-type artifacts.
- Alert on web application processes that start unexpected child processes.
- Review web access logs for upload requests from unfamiliar sources or at unusual volumes.
Limitations of the available information
- The record has no structured affected or fixed version data, so the scope of vulnerable builds is unknown beyond the stated date threshold.
- The record gives no vendor advisory, no KEV entry, no EPSS score and no SSVC decision.
- Technical details of the file upload handling are not provided, so the exact preconditions are unknown.
Frequently asked questions
What is CVE-2026-24729?
It is an unrestricted file upload weakness (CWE-434) in the file upload function of Interinfo DreamMaker versions before 2025/10/22, reported by the CNA ART@zuso.ai.
Is this vulnerability known to be exploited?
The record does not list it in the CISA KEV catalog, and no confirmed active exploitation appears in the sources consulted.
Which versions have a fix?
The record does not list fixed versions. Check the CNA advisory and the vendor for corrected releases.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.