CVE-2023-33177

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Xibo is a content management system (CMS). A path traversal vulnerability exists in the Xibo CMS whereby a specially crafted zip file can be uploaded to the CMS via the layout import function by an authenticated user which would allow creation of files outside of the CMS library directory as the webserver user. This can be used to upload a PHP webshell inside the web root directory and achieve remote code execution as the webserver user. Users should upgrade to version 2.3.17 or 3.3.5, which fix this issue. Customers who host their CMS with Xibo Signage have already received an upgrade or patch to resolve this issue regardless of the CMS version that they are running.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: May 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-331786.5Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the `/dataset/data/{id}` API route inside the CM CVE-2023-331796.5Xibo is a content management system (CMS). An SQL injection vulnerability was discovered starting in version 3.2.0 and prior to version 3.3.CVE-2023-33185.4A vulnerability was found in SourceCodester Resort Management System 1.0. It has been declared as problematic. Affected by this vulnerabilit CVE-2023-331806.5Xibo is a content management system (CMS). An SQL injection vulnerability was discovered starting in version 3.2.0 and prior to version 3.3.CVE-2023-331815.3Xibo is a content management system (CMS). Starting in version 3.0.0 and prior to version 3.3.5, some API routes will print a stack trace wh CVE-2023-331824.3Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing. The unsanitized SVG is convert CVE-2023-331834.3Calendar app for Nextcloud easily sync events from various devices with your Nextcloud. Some internal paths of the website are disclosed whe CVE-2023-331845.3Nextcloud Mail is a mail app in Nextcloud. A blind SSRF attack allowed to send GET requests to services running in the same web server. It i CVE-2023-331855.4Django-SES is a drop-in mail backend for Django. The django_ses library implements a mail backend for Django using AWS Simple Email Service.CVE-2023-331866.1Zulip is an open-source team collaboration tool with unique topic-based threading that combines the best of email and chat to make remote wo CVE-2023-331876.5Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html inp CVE-2023-331885.5Omni-notes is an open source note-taking application for Android. The Omni-notes Android app had an insufficient path validation vulnerabili