CVE-2023-7036: Unrestricted Upload of File with Dangerous Type

December 21, 2023 (updated December 29, 2023)

A vulnerability was found in automad up to 1.10.9. It has been classified as problematic. This affects the function upload of the file FileCollectionController.php of the component Content Type Handler. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248685 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but does not respond in any way.

References

github.com/advisories/GHSA-fpph-mqc8-h6q5
github.com/screetsec/VDD/tree/main/Automad%20CMS/Unrestricted%20File%20Upload
nvd.nist.gov/vuln/detail/CVE-2023-7036
vuldb.com/?ctiid.248685
vuldb.com/?id.248685

Code Behaviors & Features

Detect and mitigate CVE-2023-7036 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →