ErugoOSS/Erugo

GitHub

github.com

erugo.app

Releases17

Frequency3 weeks 1 day

Last Release 5 months ago

Stars1.07K

A powerful, self-hosted file-sharing platform built with PHP and Laravel with a Vue.js frontend. It offers secure, customizable file-transfer capabilities through an elegant user interface, giving you complete control over your data while providing a seamless experience for both senders and recipients.

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2026-24897 ↗	Jan 28, 2026Wednesday, 28 January 2026, 23:15	10 CRITICAL	—
Erugo is a self-hosted file-sharing platform. In versions up to and including 0.2.14, an authenticated low-privileged user can upload arbitrary files to any specified location due to insufficient validation of user‑supplied paths when creating shares. By specifying a writable path within the public web root, an attacker can upload and execute arbitrary code on the server, resulting in remote code execution (RCE). This vulnerability allows a low-privileged user to fully compromise the affected Erugo instance. Version 0.2.15 fixes the issue.