What’s Vulnerable › Vulnerabilities

CVE-2023-1789: Improper Input Validation in firefly-iii/firefly-iii

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-04-01 · updated 2026-06-17
• Weakness: CWE-20

Description

Improper Input Validation in GitHub repository firefly-iii/firefly-iii prior to 6.0.0.

Affected products

• firefly-iii/firefly-iii: before 5.7.18; 5.8.0-alpha1, 6.0.0-alpha1, 6.0.0-alpha2, 6.0.0-beta1 — fixed in 5.7.18

How to fix

Upgrade to a fixed version: firefly-iii/firefly-iii 5.7.18. Check the vendor advisory for mitigations.

References

• https://github.com/firefly-iii/firefly-iii/commit/6b05c0fbd3e8c40ae9b24dc2698821786fccf0c5
• https://huntr.dev/bounties/2c3489f7-6b84-48f8-9368-9cea67cf373d
• https://github.com/firefly-iii/firefly-iii/commit/6b05c0fbd3e8c40ae9b24dc2698821786fccf0c5
• https://huntr.dev/bounties/2c3489f7-6b84-48f8-9368-9cea67cf373d

Get alerted when CVE-2023-1789 or the next vulnerability affects your stack