CVE-2024-42640

angular-base64-upload versions prior to 0.1.21 contain an unauthenticated remote code execution vulnerability (CWE-434, unrestricted file upload) in the bundled demo/server.php script. An attacker with network access to that script can upload arbitrary content, which is stored under demo/uploads and can then be requested and executed by the server. Successful exploitation yields remote code execution with the privileges of the web server process, corresponding to the critical CVSS 3.1 score of 9.8 (high impact on confidentiality, integrity, and availability). Only deployments that actually expose the demo PHP file are affected, and the package is no longer supported by its maintainer, so it will not receive further fixes beyond 0.1.21. No public proof-of-concept or confirmed in-the-wild exploitation is known, but EPSS assigns a 45.4% probability of exploitation within 30 days (99th percentile), indicating elevated risk.

What to do: Upgrade to angular-base64-upload v0.1.21 or later, or replace the library given the maintainer has ended support. Remove or restrict network access to demo/server.php and demo/uploads, and ensure the uploads directory does not allow execution of uploaded files (e.g., disable PHP/script execution there). Inventory any internal or public-facing deployments running the bundled demo server, since they are the primary exposure.