Is CVE-2024-41799 actively exploited?

No active exploitation of CVE-2024-41799 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2024-41799 be exploited remotely?

Yes. CVE-2024-41799 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2024-41799?

CVE-2024-41799 has a CVSS score of 9.9 (CRITICAL).

HOME VULNERABILITIESCVE-2024-41799

CRITICAL

CVE-2024-41799

CWE-22Published: July 29, 2024· Updated: Jun 17, 2026

9.9

CVSS v3.1

Official Description

tgstation-server is a production scale tool for BYOND server management. Prior to 6.8.0, low permission users using the "Set .dme Path" privilege could potentially set malicious .dme files existing on the host machine to be compiled and executed. These .dme files could be uploaded via tgstation-server (requiring a separate, isolated privilege) or some other means. A server configured to execute in BYOND's trusted security level (requiring a third separate, isolated privilege OR being set by another user) could lead to this escalating into remote code execution via BYOND's shell() proc. The ability to execute this kind of attack is a known side effect of having privileged TGS users, but normally requires multiple privileges with known weaknesses. This vector is not intentional as it does not require control over the where deployment code is sourced from and _may_ not require remote write access to an instance's `Configuration` directory. This problem is fixed in versions 6.8.0 and above.

NVD Source

Technical Analysis

CVE-2024-41799 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.9.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.