CVE-2023-36460

CriticalCVSS 9.9/10Last modified Jun 17, 2026

Description

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 3.5.0 and prior to versions 3.5.9, 4.0.5, and 4.1.3, attackers using carefully crafted media files can cause Mastodon's media processing code to create arbitrary files at any location. This allows attackers to create and overwrite any file Mastodon has access to, allowing Denial of Service and arbitrary Remote Code Execution. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
mastodon	mastodon	>= 3.5.0, < 3.5.9; >= 4.0.0, < 4.0.5; >= 4.1.0, < 4.1.3

References

http://www.openwall.com/lists/oss-security/2023/07/06/4Mailing List
https://github.com/mastodon/mastodon/commit/dc8f1fbd976ae544720a4e07120d9a91b2722440Patch, Third Party Advisory
https://github.com/mastodon/mastodon/releases/tag/v3.5.9Third Party Advisory
https://github.com/mastodon/mastodon/releases/tag/v4.0.5Third Party Advisory
https://github.com/mastodon/mastodon/releases/tag/v4.1.3Third Party Advisory
https://github.com/mastodon/mastodon/security/advisories/GHSA-9928-3cp5-93fmThird Party Advisory
http://www.openwall.com/lists/oss-security/2023/07/06/4Mailing List
https://github.com/mastodon/mastodon/commit/dc8f1fbd976ae544720a4e07120d9a91b2722440Patch, Third Party Advisory
https://github.com/mastodon/mastodon/releases/tag/v3.5.9Third Party Advisory
https://github.com/mastodon/mastodon/releases/tag/v4.0.5Third Party Advisory
https://github.com/mastodon/mastodon/releases/tag/v4.1.3Third Party Advisory
https://github.com/mastodon/mastodon/security/advisories/GHSA-9928-3cp5-93fmThird Party Advisory

Timeline

Published: Jul 6, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-364617.5Mastodon is a free, open-source social network server based on ActivityPub. When performing outgoing HTTP queries, Mastodon sets a timeout o CVE-2023-364625.4Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 2.6.0 and prior to versions 3.5.9, 4.0.5, an CVE-2023-364636.1Meldekarten generator is an open source project to create a program, running locally in the browser without the need for an internet-connect CVE-2023-364645.5pypdf is an open source, pure-python PDF library. In affected versions an attacker may craft a PDF which leads to an infinite loop if `__par CVE-2023-364657.1Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and CVE-2023-364664.3Discourse is an open source discussion platform. When editing a topic, there is a vulnerability that enables a user to bypass the topic titl CVE-2023-364678.8AWS data.all is an open source development framework to help users build a data marketplace on Amazon Web Services. data.all versions 1.2.0 CVE-2023-364688.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When an XWiki installation is upgra CVE-2023-364698.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can edit their own use CVE-2023-36474.8The IURNY by INDIGITALL WordPress plugin before 3.2.3 does not sanitise and escape some of its settings, which could allow high privilege us CVE-2023-364708.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By either creating a new or editing CVE-2023-364715.4Xwiki commons is the common modules used by other XWiki top level projects. The HTML sanitizer that is included in XWiki since version 14.6R