An authenticated, low‑privileged user can upload arbitrary files to any location within the Erugo instance because the application does not properly validate user‑supplied paths when creating shares. The vulnerability is a classic path traversal and arbitrary file upload flaw, corresponding to CWEs 22, 434, and 94. An attacker who exploits it can place executable code in the public web root and trigger its execution, which results in full compromise of the affected Erugo instance, allowing the attacker to execute commands, exfiltrate data, or alter system configuration.

The affected product is Erugo (provided by ErugoOSS) and all releases up to and including version 0.2.14 are vulnerable. Version 0.2.15 contains a fix and removes the path validation flaw.

The vulnerability scores a base CVSS of 10.0, indicating critical impact, while the EPSS score is below 1%, implying low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local to the web application, requiring only an authenticated low‑privileged user account to create a share with a specified path, and to construct a path that places a file under a writable location within the web root. Exploitation therefore requires legitimate login credentials and the ability to control the share path. If an attacker can obtain or compromise these credentials, the risk escalates sharply to complete server compromise.