Dumbwareio Dumbdrop vulnerabilities

CVE-2025-24971 [CRITICAL] CWE-78 CVE-2025-24971: DumpDrop is a stupid simple file upload application that provides an interface for dragging and drop DumpDrop is a stupid simple file upload application that provides an interface for dragging and dropping files. An OS Command Injection vulnerability was discovered in the DumbDrop application, `/upload/init` endpoint. This vulnerability could allow an attacker to execute arbitrary code remotely when the **Apprise Notification** enabled. This issue

CVE-2025-24891 [CRITICAL] CWE-22 CVE-2025-24891: Dumb Drop is a file upload application. Users with permission to upload to the service are able to e Dumb Drop is a file upload application. Users with permission to upload to the service are able to exploit a path traversal vulnerability to overwrite arbitrary system files. As the container runs as root by default, there is no limit to what can be overwritten. With this, it's possible to inject malicious payloads into files ran on schedule or upo

CVE-2025-47929 [LOW] CWE-79 CVE-2025-47929: DumbDrop, a file upload application that provides an interface for dragging and dropping files, has DumbDrop, a file upload application that provides an interface for dragging and dropping files, has a DOM cross-site scripting vulnerability in the upload functionality prior to commit db27b25372eb9071e63583d8faed2111a2b79f1b. A user could be tricked into uploading a file with a malicious payload. Commit db27b25372eb9071e63583d8faed2111a2b79f1b fixes the