CVE-2023-26045 | NodeBB is Node.js based forum software. Starting in version … | CVSS 10.0 CRITICAL

Description

NodeBB is Node.js based forum software. Starting in version 2.5.0 and prior to version 2.8.7, due to the use of the object destructuring assignment syntax in the user export code path, combined with a path traversal vulnerability, a specially crafted payload could invoke the user export logic to arbitrarily execute javascript files on the local disk. This issue is patched in version 2.8.7. As a workaround, site maintainers can cherry pick the fix into their codebase to patch the exploit.

Metadata

CVE ID: CVE-2023-26045
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2023-02-17 22:44 UTC
Published: 2023-07-24 21:08 UTC
Last updated: 2025-02-13 16:44 UTC
Primary CWE: CWE-22
CWE-22: Improper Limitation of a Pathname to a Restricted Di…
Vendor / Product: NodeBB / NodeBB
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
NodeBB	NodeBB	—	>= 2.5.0, < 2.8.7

Weakness (CWE)

CWE	Source	Description
CWE-22	cna	CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References (3)

https://github.com/NodeBB/NodeBB/security/advisories/GHSA-vh2g-6c4x-5hmp https://github.com/NodeBB/NodeBB/security/advisories/GHSA-vh2g-6c4x-5hmp
https://github.com/NodeBB/NodeBB/commit/ec58700f6dff8e5b4af1544f6205ec362b593092 https://github.com/NodeBB/NodeBB/commit/ec58700f6dff8e5b4af1544f6205ec362b593092
https://security.netapp.com/advisory/ntap-20230831-0004/