CVE-2023-26098

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An issue was discovered in the Open Document feature in Telindus Apsal 3.14.2022.235 b. An attacker may upload a crafted file to execute arbitrary code.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://cds.thalesgroup.com/en/tcs-cert/CVE-2023-26098
https://excellium-services.com/cert-xlm-advisory/CVE-2023-26098Third Party Advisory
https://www.telindus.lu/fr/produits/apsalProduct
https://excellium-services.com/cert-xlm-advisory/CVE-2023-26098Third Party Advisory
https://www.telindus.lu/fr/produits/apsalProduct

Timeline

Published: Apr 25, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-260997.1An issue was discovered in Telindus Apsal 3.14.2022.235 b. The consultation permission is insecure.CVE-2023-26107.8Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532.CVE-2023-261006.1In Progress Flowmon before 12.2.0, an application endpoint failed to sanitize user-supplied input. A threat actor could leverage a reflected CVE-2023-261017.5In Progress Flowmon Packet Investigator before 12.1.0, a Flowmon user with access to Flowmon Packet Investigator could leverage a path-trave CVE-2023-261028.2All versions of the package rangy are vulnerable to Prototype Pollution when using the extend() function in file rangy-core.js.The function CVE-2023-261037.5Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket functi CVE-2023-261047.5All versions of the package lite-web-server are vulnerable to Denial of Service (DoS) when an attacker sends an HTTP request and includes co CVE-2023-261057.5All versions of the package utilities are vulnerable to Prototype Pollution via the _mix function.CVE-2023-261067.5All versions of the package dot-lens are vulnerable to Prototype Pollution via the set() function in index.js file.CVE-2023-261077.8All versions of the package sketchsvg are vulnerable to Arbitrary Code Injection when invoking shell.exec without sanitization nor parametri CVE-2023-261085.3Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe. Exploiting this vulner CVE-2023-261099.8All versions of the package node-bluetooth-serial-port are vulnerable to Buffer Overflow via the findSerialPortChannel method due to imprope