Astroid Framework (astroid) 2.0.0 to 3.3.10 - Unauthenticated Arbitrary File Upload (RCE)
Astroid Framework by TemPlaza, versions 2.0.0 through 3.3.10, exposes an improperly secured file management feature on its AJAX endpoint. An unauthenticated attacker can upload dangerous file types, leading to remote code execution on the server. Astroid is a template framework, so the vulnerable code is present on every site whose template is built on it, regardless of which template is active. Fixed in 3.3.11, which the vendor released on 5 March 2026 with the note "Fixing security vulnerabilities at the AJAX endpoint". Update the Astroid Framework plugin to 3.3.11 or later (current release is 3.4.2). There is no configuration-level mitigation: the endpoint is reachable without a login.
Affected versions: ≥ 2.0.0 and ≤ 3.3.10
Full advisory: github.com
