Threats affecting pkg:github/erugooss/Erugo

CVE-2026-24897 is a critical path traversal vulnerability in Erugo, a self-hosted file-sharing platform, affecting versions prior to 0.2.15. An authenticated low-privileged user can exploit insufficient validation of user-supplied paths to upload arbitrary files anywhere on the server, including writable paths within the public web root. This enables remote code execution (RCE), allowing full compromise of the Erugo instance without requiring elevated privileges or user interaction. The vulnerability stems from improper limitation of pathname (CWE-22) and leads to code injection (CWE-94) and unrestricted file upload (CWE-434). Although no known exploits are reported in the wild yet, the CVSS 3.1 score is 10.0, reflecting the critical severity. Organizations using affected Erugo versions should upgrade to 0.