CVE-2024-28713 is a critical remote code execution vulnerability in Mblog Blog system version 3.5.0. The flaw arises from improper handling of file uploads in the theme management functionality, classified under CWE-434 (Unrestricted Upload of File with Dangerous Type). An attacker can exploit this by submitting a crafted file to execute arbitrary code on the affected system without requiring privileges or user interaction. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary code on the server running Mblog Blog system 3.5.0. This can lead to full system compromise, including data theft, data modification, and denial of service. The vulnerability affects confidentiality, integrity, and availability at a critical level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict access to the theme management feature, disable file uploads if possible, and monitor for suspicious activity related to file uploads. Avoid exposing the affected version to untrusted networks.