CVE-2023-32676

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Autolab is a course management service that enables auto-graded programming assignments. A Tar slip vulnerability was found in the Install assessment functionality of Autolab. To exploit this vulnerability an authenticated attacker with instructor permissions needs to upload a specially crafted Tar file. Using the install assessment functionality an attacker can feed a Tar file that contain files with paths pointing outside of the target directory (e.g., `../../../../tmp/tarslipped1.sh`). When the Install assessment form is submitted the files inside of the archives are expanded to the attacker-chosen locations. This issue has been addressed in version 2.11.0. Users are advised to upgrade.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: May 26, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-326773.1Zulip is an open-source team collaboration tool with unique topic-based threading. Zulip administrators can configure Zulip to limit who can CVE-2023-326786.5Zulip is an open-source team collaboration tool with topic-based threading that combines email and chat. Users who used to be subscribed to CVE-2023-326797.2Craft CMS is an open source content management system. In affected versions of Craft CMS an unrestricted file extension may lead to Remote C CVE-2023-32687.1An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in kernel/relay.c in the relayfs. This CVE-2023-326809.6Metabase is an open source business analytics engine. To edit SQL Snippets, Metabase should have required people to be in at least one group CVE-2023-326816.1Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirect CVE-2023-326825.4Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. In affected versions it may be possible for a deactiva CVE-2023-326835.4Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. A discovered oEmbed or image URL can bypass the `url_p CVE-2023-326842.5Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to version 0.16.0, a virtual machine instance with a CVE-2023-326855.4Kanboard is project management software that focuses on the Kanban methodology. Due to improper handling of elements under the `contentEdita CVE-2023-326865.4Kiwi TCMS is an open source test management system for both manual and automated testing. Kiwi TCMS allows users to upload attachments to te CVE-2023-326876.5tgstation-server is a toolset to manage production BYOND servers. Starting in version 4.7.0 and prior to 5.12.1, instance users with the lis