CVE-2023-31541

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-06-13 · updated 2026-07-09
Weakness: CWE-434

Description

A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’ feature of the CKEditor v1.2.3 plugin for Redmine, which allows arbitrary files to be uploaded to the server.

Affected products

ckeditor4: 1.2.3

References

https://github.com/DreamD2v/CVE-2023-31541/blob/main/CVE-2023-31541.md
https://github.com/DreamD2v/CVE-2023-31541/blob/main/CVE-2023-31541.md

Get alerted when CVE-2023-31541 or the next vulnerability affects your stack