CVE-2024-58279 is an authenticated remote code execution vulnerability in appRain CMF 4.0.5. The issue arises from unrestricted upload of files with dangerous types, specifically allowing administrative users to upload crafted PHP files through the filemanager upload endpoint. Exploiting this vulnerability enables attackers with administrative privileges to upload a web shell, resulting in full command execution on the affected system.

Successful exploitation allows an attacker with administrative access to execute arbitrary code on the server by uploading malicious PHP files. This can lead to complete compromise of the affected system, including unauthorized control and potential data breaches. The vulnerability has a CVSS 4.0 score of 8.6, indicating high severity with network attack vector, low attack complexity, and no user interaction required beyond authentication.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted users only and monitor upload endpoints for suspicious activity. Consider implementing additional file upload validation and restrictions to prevent uploading executable files.