CVE-2024-56828 | ChestnutCMS up to 1.5.0 API Endpoint /api/member/avatar Base64.getDecoder.decode suffix unrestricted upload

A vulnerability, which was classified as critical, has been found in ChestnutCMS up to 1.5.0. Affected by this issue is the function Base64.getDecoder.decode of the file /api/member/avatar of the component API Endpoint. The manipulation of the argument suffix leads to unrestricted upload.

This vulnerability is handled as CVE-2024-56828. The attack may be launched remotely. There is no exploit available.