CVE-2024-28187

SOY CMS is an open source CMS (content management system) that allows you to build blogs and online shops. SOY CMS versions prior to 3.14.2 are vulnerable to an OS Command Injection vulnerability within the file upload feature when accessed by an administrator. The vulnerability enables the execution of arbitrary OS commands through specially crafted file names containing a semicolon, affecting the jpegoptim functionality. This vulnerability has been patched in version 3.14.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-78
• CWE-78

• https://github.com/inunosinsi/soycms/commit/9b0e452f628df28dec69cd72b6b55db21066cbf8Patch
• https://github.com/inunosinsi/soycms/security/advisories/GHSA-qg3q-hfgc-5jmmVendor Advisory
• https://github.com/inunosinsi/soycms/commit/9b0e452f628df28dec69cd72b6b55db21066cbf8Patch
• https://github.com/inunosinsi/soycms/security/advisories/GHSA-qg3q-hfgc-5jmmVendor Advisory

Published

Mar 11, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-28181 turbo_boost-commands is a set of commands to help you build…8.1
• CVE-2024-28182nghttp2 is an implementation of the Hypertext Transfer Proto…5.3
• CVE-2024-28183ESP-IDF is the development framework for Espressif SoCs supp…5.7
• CVE-2024-28184WeasyPrint helps web developers to create PDF documents. Sin…7.4
• CVE-2024-28185Judge0 is an open-source online code execution system. The a…10
• CVE-2024-28186FreeScout is an open source help desk and shared inbox built…7.1
• CVE-2024-28188Jupyter Scheduler is collection of extensions for programmin…5.3
• CVE-2024-28189Judge0 is an open-source online code execution system. The a…10
• CVE-2024-2819Incorrect Default Permissions, Improper Preservation of Perm…6.5
• CVE-2024-28190Contao is an open source content management system. Starting…5.4
• CVE-2024-28191Contao is an open source content management system. Starting…5.4
• CVE-2024-28192your_spotify is an open source, self hosted Spotify tracking…5.3