CVE-2023-26441

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Cacheservice did not correctly check if relative cache object were pointing to the defined absolute location when accessing resources. An attacker with access to the database and a local or restricted network would be able to read arbitrary local file system resources that are accessible by the services system user account. We have improved path validation and make sure that any access is contained to the defined root directory. No publicly available exploits are known.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200CWE-22

Affected software

VendorProductVersions
OX Software GmbHOX App Suite<= 8.10

References

Timeline

Published
Aug 2, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-264423.2In case Cacheservice was configured to use a sproxyd object-storage backend, it would follow HTTP redirects issued by that backend. An attacCVE-2023-264439.8Full-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements. With existing sanitization in place, this caCVE-2023-264455.4Frontend themes are defined by user-controllable jslob settings and could point to a malicious resource which gets processed during login. MCVE-2023-264465.4The users clientID at "application passwords" was not sanitized or escaped before being added to DOM. Malicious script code can be executed CVE-2023-264475.4The "upsell" widget for the portal allows to specify a product description. This description taken from a user-controllable jslob did not geCVE-2023-264485.4Custom log-in and log-out locations are used-defined as jslob but were not checked to contain malicious protocol handlers. Malicious script CVE-2023-264495.4The "OX Chat" web service did not specify a media-type when processing responses by external resources. Malicious script code can be executeCVE-2023-26459.8A vulnerability, which was classified as critical, was found in USR USR-G806 1.0.41. Affected is an unknown function of the component Web MaCVE-2023-264505.4The "OX Count" web service did not specify a media-type when processing responses by external resources. Malicious script code can be executCVE-2023-264517.5Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service. AuthorizatiCVE-2023-264528.8Requests to cache an image and return its metadata could be abused to include SQL queries that would be executed unchecked. Exploiting this CVE-2023-264538.8Requests to cache an image could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires a
CVE-2023-26441: Medium severity, CVSS 5.5 | Vulnix