Chevereto 3.13.4 Core - Remote Code Execution

The vulnerability lies in how Chevereto handles the database table prefix during installation. An attacker can manipulate this parameter to write a PHP shell file to the server's filesystem. Subsequently, they can execute arbitrary system commands through a crafted POST request. This effectively grants the attacker complete control over the affected server, enabling them to steal sensitive data, install malware, or use the server as a launchpad for further attacks. The potential blast radius is significant, as a compromised Chevereto instance can expose the entire server and potentially connected systems.

Organizations and individuals using Chevereto for image sharing, particularly those running older, unpatched versions (3.13.4 and earlier), are at significant risk. Shared hosting environments that host Chevereto installations are also vulnerable, as a compromise of one instance could potentially affect other users on the same server.

• php / web:

curl -X POST -d 'table_prefix=<?php system($_GET["cmd"]); ?>' http://your-chevereto-site/install/ | grep '<?php system($_GET["cmd"]); ?>'

• generic web:

curl -I http://your-chevereto-site/install/

Check response headers for unusual content or redirects. • generic web:

 grep -r 'system($_GET["cmd"]);' /var/www/your-chevereto-site/*

Search for the malicious PHP code within the Chevereto installation directory.

1. 2026-02-11Disclosure

   disclosure

1. Reservado2026-02-10
2. Publicada2026-02-11
3. Modificada2026-03-05
4. EPSS atualizado2026-03-23

The primary mitigation is to upgrade Chevereto to a version that addresses this vulnerability. Consult the Chevereto website for the latest stable release. If immediate upgrading is not possible due to compatibility issues or downtime concerns, consider temporarily restricting access to the installation script or modifying the database configuration process to prevent malicious input. Web Application Firewalls (WAFs) configured to detect and block suspicious POST requests targeting the installation endpoint can also provide a layer of protection. Monitor Chevereto logs for unusual activity, particularly related to database configuration changes.