What’s Vulnerable › Vulnerabilities

CVE-2023-45880

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-11-14 · updated 2026-06-17
• Weakness: CWE-22

Description

GibbonEdu Gibbon through version 25.0.0 allows Directory Traversal via the report template builder. An attacker can create a new Asset Component. The templateFileDestination parameter can be set to an arbitrary pathname (and extension). This allows creation of PHP files outside of the uploads directory, directly in the webroot.

Affected products

• gibbonedu gibbon: through 25.0.00

References

• https://herolab.usd.de/security-advisories/usd-2023-0022/
• https://herolab.usd.de/security-advisories/usd-2023-0022/

Get alerted when CVE-2023-45880 or the next vulnerability affects your stack