CVE-2023-46865

/api/v1/company/upload-logo in CompanyController.php in crater through 6.0.6 allows a superadmin...

7.2 HighPublic exploit

/api/v1/company/upload-logo in CompanyController.php in crater through 6.0.6 allows a superadmin to execute arbitrary PHP code by placing this code into an image/png IDAT chunk of a Company Logo image.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

23.8%Up 23.8 points since Oct 30, 2023

What each source reports

NVD Score used 7.2

Record: CVE-2023-46865
CVSS 3.1: 7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

CVE List No score

Record: CVE-2023-46865
Updated: 2026-11-02

EUVDEUVD-2023-51031 No score

Record: EUVD-2023-51031
Updated: 2026-11-03

GitHub AdvisoriesGHSA-5cw4-vrv3-8qx9 7.2

/api/v1/company/upload-logo in CompanyController.php in crater through 6.0.6 allows a superadmin...

Record: GHSA-5cw4-vrv3-8qx9
CVSS 3.1: 7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

OSV No score

Record: CVE-2023-46865
Updated: 2026-11-02

Affected products

craterapp crater

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	asylumdx/Crater-CVE-2023-46865-RCE	2023-11-09

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-46865 is a high vulnerability (CVSS 7.2) in Craterapp Crater, published October 30, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 23.8%, the 97th percentile. No source names a fixed version.