CVE-2024-48514 is a critical remote code execution vulnerability affecting php-heic-to-jpg, a PHP library used to convert HEIC image files to JPG format. Versions 1.0.5 and below improperly sanitize or validate the filenames of uploaded HEIC images, allowing attackers to inject malicious code via crafted filenames. When the library processes these files, the injected code can be executed on the server, leading to full compromise of the system. This vulnerability falls under CWE-94, indicating that the application improperly controls the generation of executable code. The vulnerability requires no authentication or user interaction and can be exploited remotely by simply uploading a malicious HEIC image. The CVSS v3.1 base score is 9.8, reflecting its critical severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The impact includes complete loss of confidentiality, integrity, and availability (CIA triad). Although no public exploits are currently known, the vulnerability's nature and ease of exploitation make it a high-risk threat. The issue was fixed in php-heic-to-jpg version 1.0.6, which properly sanitizes filenames to prevent code injection.

The vulnerability allows attackers to execute arbitrary code on servers running vulnerable versions of php-heic-to-jpg, potentially leading to full system compromise. This can result in unauthorized data access or theft, data manipulation, service disruption, or use of the compromised server as a foothold for further attacks within an organization’s network. Since the vulnerability affects a library commonly used in web applications handling HEIC image uploads, any organization processing such images is at risk. The ease of exploitation without authentication or user interaction increases the likelihood of automated attacks and widespread exploitation once public exploits emerge. The compromise of confidentiality, integrity, and availability can have severe consequences including data breaches, ransomware deployment, and operational downtime.

Organizations should immediately upgrade php-heic-to-jpg to version 1.0.6 or later, where the vulnerability is patched. Until the update can be applied, implement strict input validation and sanitization on all uploaded filenames, especially HEIC images, to block potentially malicious characters or patterns. Employ web application firewalls (WAFs) with rules to detect and block suspicious file uploads or payloads targeting this vulnerability. Restrict file upload permissions and isolate image processing components in sandboxed environments to limit potential damage from exploitation. Monitor logs for unusual file upload activity or errors related to image processing. Additionally, conduct regular security audits and vulnerability scans to detect outdated library versions and ensure timely patching. Educate developers and administrators about secure file handling practices to prevent similar vulnerabilities.