CVE-2024-25636

CVE-2024-25636 is a high-severity vulnerability affecting Misskey, an open-source decentralized social media platform, prior to version 2024.2.0. The flaw, categorized as CWE-434 (Unrestricted Upload of File with Dangerous Type), allows an attacker to impersonate and take over accounts on vulnerable remote servers due to improper validation of Activity Streams object content types. The vulnerability carries a CVSS score of 8.8 (HIGH), indicating a network-based attack with low attack complexity and no user interaction required, leading to high impacts on confidentiality, integrity, and availability. Exploitation requires specific conditions on the remote server, including arbitrary user uploads and specific content serving behaviors. Currently, there is no evidence of active exploitation, nor are there publicly available exploit codes in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, which is typical for the majority of reported vulnerabilities.