CVE-2023-35801

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

A directory traversal vulnerability in Safe Software FME Server before 2022.2.5 allows an attacker to bypass validation when editing a network-based resource connection, resulting in the unauthorized reading and writing of arbitrary files. Successful exploitation requires an attacker to have access to a user account with write privileges. FME Flow 2023.0 is also a fixed version.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://community.safe.com/s/Product
https://community.safe.com/s/article/Known-Issue-FME-Flow-Directory-Traversal-VulnerabilityMitigation, Vendor Advisory
https://downloads.safe.com/fme/2023/whatsnew_server_2023_0_0_3.txtRelease Notes
https://community.safe.com/s/Product
https://community.safe.com/s/article/Known-Issue-FME-Flow-Directory-Traversal-VulnerabilityMitigation, Vendor Advisory
https://downloads.safe.com/fme/2023/whatsnew_server_2023_0_0_3.txtRelease Notes

Timeline

Published: Jun 23, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-358029.8IQ Engine before 10.6r1 on Extreme Network AP devices has a Buffer Overflow in the implementation of the CAPWAP protocol that may be exploit CVE-2023-358039.8IQ Engine before 10.6r2 on Extreme Network AP devices has a Buffer Overflow.CVE-2023-358088.8An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. An Unrestricted File Upload vulnerability has been iden CVE-2023-358098.8An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. A Bean Manipulation vulnerability has been identified i CVE-2023-35818.1Mattermost fails to properly validate the origin of a websocket connection allowing a MITM attacker on Mattermost to access the websocket AP CVE-2023-358107.2An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. A Second-Order PHP Object Injection vulnerability has b CVE-2023-358118.8An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. Two SQL Injection vectors have been identified in the R CVE-2023-358125.3An issue was discovered in the Amazon Linux packages of OpenSSH 7.4 for Amazon Linux 1 and 2, because of an incomplete fix for CVE-2019-6111 CVE-2023-358139.8Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experience Commerce throug CVE-2023-358149.8DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms.CVE-2023-358159.8DevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on XML data.CVE-2023-358165.3DevExpress before 23.1.3 allows arbitrary TypeConverter conversion.