critical10.0
CVE-2023-26045
Path traversal and code execution via prototype vulnerability
Impact
### Impact Due to the use of the [object destructuring assignment](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/Destructuring_assignment) syntax in the user export code path, combined with a path traversal vulnerability, a specially crafted payload could invoke the user export logic to arbitrarily execute javascript files on the local disk. ### Patches Patched in v2.8.7 ### Workarounds Site maintainers can cherry pick ec58700f6dff8e5b4af1544f6205ec362b593092 into their codebase to patch the exploit.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | nodebb | >= 2.5.0, < 2.8.7 | 2.8.7 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nodebb | Nodebb | from 2.5.0 before 2.8.7 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/NodeBB/NodeBB/commit/ec58700f6dff8e5b4af1544f6205ec362b593092
- https://github.com/NodeBB/NodeBB/security/advisories/GHSA-vh2g-6c4x-5hmp
- https://security.netapp.com/advisory/ntap-20230831-0004/
- https://github.com/advisories/GHSA-vh2g-6c4x-5hmp
- https://nvd.nist.gov/vuln/detail/CVE-2023-26045