First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2023-26126

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

All versions of the package m.static are vulnerable to Directory Traversal due to improper input sanitization of the path being requested via the requestFile function.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
n/a	m.static	< *

References

https://gist.github.com/lirantal/dcb32c11ce87f5aafd2282b90b4dc998Exploit, Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-MSTATIC-3244915Exploit, Third Party Advisory
https://gist.github.com/lirantal/dcb32c11ce87f5aafd2282b90b4dc998Exploit, Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-MSTATIC-3244915Exploit, Third Party Advisory

Timeline

Published: May 10, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-261277.8All versions of the package n158 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports' function. *CVE-2023-261287.8All versions of the package keep-module-latest are vulnerable to Command Injection due to missing input sanitization or other checks and san CVE-2023-261297.8All versions of the package bwm-ng are vulnerable to Command Injection due to improper input sanitization in the 'check' function in the bwm CVE-2023-261308.8Versions of the package yhirose/cpp-httplib before 0.12.4 are vulnerable to CRLF Injection when untrusted user input is used to set the cont CVE-2023-261316.1All versions of the package github.com/xyproto/algernon/engine; all versions of the package github.com/xyproto/algernon/themes are vulnerabl CVE-2023-261327.5Versions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the set() function and the CVE-2023-261339.8All versions of the package progressbar.js are vulnerable to Prototype Pollution via the function extend() in the file utils.js.CVE-2023-261349.8Versions of the package git-commit-info before 2.0.2 are vulnerable to Command Injection such that the package-exported method gitCommitInfo CVE-2023-261359.8All versions of the package flatnest are vulnerable to Prototype Pollution via the nest() function in the flatnest/nest.js file.CVE-2023-261369.8Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using Cooki CVE-2023-261376.1All versions of the package drogonframework/drogon are vulnerable to HTTP Response Splitting when untrusted user input is used to build head CVE-2023-261384.3All versions of the package drogonframework/drogon are vulnerable to CRLF Injection when untrusted user input is used to set request headers