What’s Vulnerable › Vulnerabilities

CVE-2023-7305: SmartBI RMIServlet Unrestricted File Upload RCE

• Severity: critical (CVSS 9.2 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-10-15 · updated 2026-09-03
• Weakness: CWE-434

Description

SmartBI V8, V9, and V10 contain an unrestricted file upload vulnerability via the RMIServlet request handling logic. Under certain configurations or usage patterns, attackers can send specially crafted requests that cause the application to perform sensitive operations or execute arbitrary code on the host. The vendor released a fix in July 2023 to address the underlying flaw. VulnCheck has observed this vulnerability being exploited in the wild.

Affected products

• Guangzhou Smart Software Co., Ltd. SmartBI: from V8 before July 2023 update; from V9 before July 2023 update; from V10 before July 2023 update — fixed in July 2023 update

How to fix

Upgrade to a fixed version: Guangzhou Smart Software Co., Ltd. SmartBI July 2023 update. Check the vendor advisory for mitigations.

References

• https://avd.aliyun.com/detail?id=AVD-2023-1673292
• https://jeyiuwai.pages.dev/posts/1day-%E8%B7%9F%E8%B8%AAsmartbi-rmiservlet-%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E/
• https://www.smartbi.com.cn/patchinfo
• https://www.vulncheck.com/advisories/smartbi-rmiservlet-unrestricted-file-upload-rce

Get alerted when CVE-2023-7305 or the next vulnerability affects your stack