CVE-2020-24807

The socket.io-file package through 2.0.31 for Node.js relies on client-side validation of file types, which allows remote attackers to execute arbitrary code by uploading an executable file via a modified JSON name field. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

• CWE-20

• https://github.com/advisories/GHSA-6495-8jvh-f28xThird Party Advisory
• https://github.com/rico345100/socket.io-fileProduct, Third Party Advisory
• https://www.npmjs.com/advisories/1564Third Party Advisory
• https://www.npmjs.com/package/socket.io-fileProduct, Third Party Advisory
• https://github.com/advisories/GHSA-6495-8jvh-f28xThird Party Advisory
• https://github.com/rico345100/socket.io-fileProduct, Third Party Advisory
• https://www.npmjs.com/advisories/1564Third Party Advisory
• https://www.npmjs.com/package/socket.io-fileProduct, Third Party Advisory

Published

Oct 6, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-24771Incorrect access control in NexusPHP 1.5.beta5.20120707 allo…7.5
• CVE-2020-24772In Dreamacro Clash for Windows v0.11.4, an attacker could em…8.8
• CVE-2020-24786An issue was discovered in Zoho ManageEngine Exchange Report…9.8
• CVE-2020-24791FUEL CMS 1.4.8 allows SQL injection via the 'fuel_replace_id…9.8
• CVE-2020-24794Cross Site Scripting (XSS) vulnerability in Kentico before 1…6.1
• CVE-2020-24804Plaintext Password vulnerability in AddAdmin.py in cms-dev/c…6.5
• CVE-2020-24815A Server-Side Request Forgery (SSRF) affecting the PDF gener…6.5
• CVE-2020-24821A vulnerability in the dwarf::cursor::skip_form function of …5.5
• CVE-2020-24822A vulnerability in the dwarf::cursor::uleb function of Libel…5.5
• CVE-2020-24823A vulnerability in the dwarf::to_string function of Libelfin…5.5
• CVE-2020-24824A global buffer overflow issue in the dwarf::line_table::lin…5.5
• CVE-2020-24825A vulnerability in the line_table::line_table function of Li…5.5