CVE-2023-48710: iTop limit pages/exec.php script to PHP files

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-04-15 · updated 2026-06-17
Weakness: CWE-552

Description

iTop is an IT service management platform. Files from the `env-production` folder can be retrieved even though they should have restricted access. Hopefully, there is no sensitive files stored in that folder natively, but there could be from a third-party module. The `pages/exec.php` script as been fixed to limit execution of PHP files only. Other file types won't be retrieved and exposed. The vulnerability is fixed in 2.7.10, 3.0.4, 3.1.1, and 3.2.0.

Affected products

Combodo iTop: before 2.7.10; from 3.0.0 before 3.0.4; from 3.1.0 before 3.1.1 — fixed in 2.7.10, 3.0.4, 3.1.1

How to fix

Upgrade to a fixed version: Combodo iTop 2.7.10, 3.0.4, 3.1.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-48710 or the next vulnerability affects your stack