CVE-2023-47246
SysAid Server Path Traversal Vulnerability
CVSS
9.8
Crítico
EPSS
98.9%
p100
KEV
SÍ
13 nov 2023
Exploit Today
80
0-100
Publicado: 10 nov 2023 · Última mod.: 31 jul 2026 · CWE-22
98.9%EPSS · 30 días98.9%
2026-09-162026-10-14
Producto
SysAid / SysAid Server
Vulnerabilidad
SysAid Server Path Traversal Vulnerability
Añadido a KEV
13 nov 2023
Remediar antes de
4 dic 2023
Uso conocido en ransomware
Sí
Descripción resumida
SysAid Server (on-premises version) contains a path traversal vulnerability that leads to code execution.
Acción requerida
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notas
https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification; https://nvd.nist.gov/vuln/detail/CVE-2023-47246
In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as exploited in the wild in November 2023.
- documentation.sysaid.comhttps://documentation.sysaid.com/docs/latest-version-installation-files
- documentation.sysaid.comhttps://documentation.sysaid.com/docs/on-premise-security-enhancements-2023
- www.sysaid.comhttps://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification
- documentation.sysaid.comhttps://documentation.sysaid.com/docs/latest-version-installation-files
- documentation.sysaid.comhttps://documentation.sysaid.com/docs/on-premise-security-enhancements-2023
- www.sysaid.comhttps://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification
- www.cisa.govhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-47246
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-626645.4 MED—
——0FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.19.0, FileRise validates the complete folderName string but does not reject dot-dot path segments before FolderModel::createFolder() constructs and creates the destination. An authenticated low-privileged user with a valid CSRF token and create or owner permission on the parent can submit traversal segments to POST /api/folder/createFolder.php and create directories outside UPLOAD_DIR wherever the web-server account can write. This issue is fixed in version 3.19.0.9hCVE-2026-1041076.5 MED—
——0FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In FileRise 3.22.0, the /api/file/saveFile.php operation accepts dot and dot-dot segments in its attacker-controlled folder input before ACL inheritance evaluates the uncanonicalized string. With an authenticated non-administrator session, a valid CSRF token, and inherited edit permission on a legitimate ancestor, the local filesystem or WebDAV adapter later resolves those segments as path navigation, permitting attacker-controlled file creation outside the authorized folder and, where backend credentials permit, outside the configured WebDAV root. Local storage also created directories before final containment validation and used a prefix comparison that accepted similarly named sibling roots. This issue is fixed in version 3.23.0.9hCVE-2026-0312——
——0Path traversal vulnerabilities in Palo Alto Networks Checkov by Prisma® Cloud enable an unauthenticated local user to write files to arbitrary locations on the scanning filesystem.9hCVE-2026-1107664.3 MED—
——0Colanode server through 0.4.7 contains a path traversal vulnerability that allows authenticated users to read arbitrary .jpeg files by supplying an encoded traversal sequence in avatarId. Attackers can send percent-encoded ../ sequences to GET /client/v1/avatars/:avatarId to escape the avatars directory and read .jpeg files belonging to other workspaces.10hCVE-2026-1106666.5 MED—
——0A vulnerability was identified in cemtan sar2html 4.0.0. Affected is the function updateDb of the file sar2html.py of the component File Upload. The manipulation leads to path traversal. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.11hCVE-2026-100406——
——0dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. From 2.0.0-alpha.0 until 2.0.0-alpha.5, dbt docs serve exposes the unauthenticated POST /api/v1/query endpoint in crates/dbt-docs-server/src/handlers/query.rs, which passes caller-supplied SQL to DuckDbViewsBackend::query_arrow() in crates/dbt-index-core/src/backend.rs without authorization or an allowlist. A client that can reach the server can invoke DuckDB filesystem-reading functions to read files available to the dbt process, including files outside the docs index directory. The server binds to localhost by default, but operators can expose it to a network through the host option or DBT_DOCS_HOST setting. This issue is fixed in version 2.0.0-alpha.5.11h