CVE-2023-42803: BigBlueButton Unrestricted File Upload vulnerability

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-10-30 · updated 2026-06-17
Weakness: CWE-434

Description

BigBlueButton is an open-source virtual classroom. BigBlueButton prior to version 2.6.0-beta.2 is vulnerable to unrestricted file upload, where the insertDocument API call does not validate the given file extension before saving the file, and does not remove it in case of validation failures. BigBlueButton 2.6.0-beta.2 contains a patch. There are no known workarounds.

Affected products

bigbluebutton: through 2.5.18; 2.6.0-alpha1, 2.6.0-alpha2, 2.6.0-alpha3, 2.6.0-alpha4, 2.6.0-beta1

References

https://github.com/bigbluebutton/bigbluebutton/pull/15990
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-w98f-6x8w-xhjc
https://github.com/bigbluebutton/bigbluebutton/pull/15990
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-w98f-6x8w-xhjc

Get alerted when CVE-2023-42803 or the next vulnerability affects your stack