What’s Vulnerable › Vulnerabilities

CVE-2023-50090

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-01-03 · updated 2026-06-17

Description

Arbitrary File Write vulnerability in the saveReportFile method of ureport2 2.2.9 and before allows attackers to write arbitrary files and run arbitrary commands via crafted POST request.

Affected products

• com.bstek.ureport:ureport2-console: through 2.2.9

References

• https://lemono.fun/thoughts/UReport2-RCE.html
• https://github.com/advisories/GHSA-445x-c8qq-qfr9
• https://lemono.fun/thoughts/UReport2-RCE.html

Get alerted when CVE-2023-50090 or the next vulnerability affects your stack