CVE-2023-47246
SysAid Server Path Traversal Vulnerability
CVSS
9.8
Critical
EPSS
98.9%
p100
KEV
YES
Nov 13, 2023
Exploit Today
80
0-100
Published: Nov 10, 2023 · Last modified: Jul 31, 2026 · CWE-22
98.9%EPSS · 30 days98.9%
2026-08-022026-08-30
Product
SysAid / SysAid Server
Vulnerability
SysAid Server Path Traversal Vulnerability
Added to KEV
Nov 13, 2023
Remediate by
Dec 4, 2023
Known ransomware use
Yes
Summary description
SysAid Server (on-premises version) contains a path traversal vulnerability that leads to code execution.
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes
https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification; https://nvd.nist.gov/vuln/detail/CVE-2023-47246
In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as exploited in the wild in November 2023.
- documentation.sysaid.comhttps://documentation.sysaid.com/docs/latest-version-installation-files
- documentation.sysaid.comhttps://documentation.sysaid.com/docs/on-premise-security-enhancements-2023
- www.sysaid.comhttps://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification
- documentation.sysaid.comhttps://documentation.sysaid.com/docs/latest-version-installation-files
- documentation.sysaid.comhttps://documentation.sysaid.com/docs/on-premise-security-enhancements-2023
- www.sysaid.comhttps://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification
- www.cisa.govhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-47246
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-82673——
———Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in ash-project ash_admin allows writing attacker-controlled bytes to arbitrary paths on the server.
AshAdmin.Components.Resource.Form.consume_file_uploads/1 builds the destination as Path.join([tmp_dir, entry.client_name]) and writes it with File.cp!/2. entry.client_name is the browser-supplied filename and is not sanitized, and Path.join/1 does not normalize ... An upload named ../../../../var/www/app/priv/static/x.png therefore escapes the random temp directory and lands anywhere the BEAM user can write, enabling arbitrary file write and potentially remote code execution by overwriting application assets, configuration, or cron/ssh files. The only guard is an extension allowlist defaulting to :any that checks only the extension. The fix strips path components with Path.basename/1 before joining.
This issue affects ash_admin: from 0.13.7 before 1.3.1.2hCVE-2026-826035.4 MED—
———A vulnerability was detected in SeaCMS up to 13.6. This issue affects some unknown processing of the file /member.php?action=del_pl of the component Comment Cache. The manipulation of the argument itype/vid results in path traversal. The attack may be launched remotely. The exploit is now public and may be used.3hCVE-2026-825995.4 MED—
———A vulnerability was identified in SeaCMS up to 13.6. Affected by this vulnerability is the function unlink of the file /member.php?action=chgpwdsubmit of the component Avatar Upload. Such manipulation of the argument oldpic leads to path traversal. It is possible to launch the attack remotely. The exploit is publicly available and might be used.4hCVE-2026-567187.5 HIG—
———AJCloud AJY IPC firmware prior to version 01.10715.11.37 contains a path traversal vulnerability in the jdbhttpd web service that allows unauthenticated remote attackers to read arbitrary files with root privileges by supplying path traversal sequences in the HTTP request URI. Attackers can send crafted HTTP requests to port 80 without authentication to access sensitive files including cleartext RTSP credentials, Wi-Fi SSID and pre-shared key, device serial number, and cloud binding parameters.8hCVE-2026-826562.6 LOW—
——0Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated users with album-creation rights to include path traversal segments in archive entry names. Attackers can craft malicious album names containing directory traversal sequences that escape the intended directory when recipients extract the archive, potentially writing files outside the target directory.14hCVE-2026-826358.8 HIG—
——0Pake before 3.13.1 joins the JavaScript-supplied filename for the download_file Tauri command onto the user's Downloads directory with no sanitization. A filename containing path traversal sequences (for example ../Library/LaunchAgents/com.evil.plist) or an absolute path resolves outside ~/Downloads. The command then fetches attacker-controlled content from the supplied URL (via Rust HTTP, not the browser) and writes it to that path. A script that can invoke the command can overwrite user-writable files and install persistence (macOS LaunchAgents, Linux autostart, Windows Startup), leading to code execution in the user account. All desktop apps generated from an affected Pake tree expose the same command.16h