CVE-2023-47621
Remote code execution via file uploads in guest-entries
Guest Entries is a php library which allows users to create, update & delete entries from the front-end of a site. In affected versions the file uploads feature did not prevent the upload of PHP files. This may lead to code execution on the server by authenticated users. This vulnerability is fixed in v3.1.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Remote code execution via file uploads in guest-entries
Guest Entries is a php library which allows users to create, update & delete entries from the front-end of a site. In affected versions the file uploads feature did not prevent the upload of PHP files. This may lead to code execution on the server by authenticated users. This vulnerability is fixed in v3.1.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2023-47621- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-434
- Updated
- 2026-11-02
EUVDEUVD-2023-3033
Guest Entries is a php library which allows users to create, update & delete entries from the front-end of a site. In affected versions the file uploads feature did not prevent the upload of PHP files. This may lead to code execution on the server by authenticated users. This vulnerability is fixed in v3.1.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
EUVD-2023-3033- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rw82-mhmx-grmj
Guest Entries Remote code execution via file uploads
Impact
When using the file uploads feature, it was possible to upload PHP files.
Patches
The vulnerability is fixed in v3.1.2.
- Record
GHSA-rw82-mhmx-grmj- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-434
- Updated
- 2026-11-02
NVD
Guest Entries is a php library which allows users to create, update & delete entries from the front-end of a site. In affected versions the file uploads feature did not prevent the upload of PHP files. This may lead to code execution on the server by authenticated users. This vulnerability is fixed in v3.1.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2023-47621- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-434
- Updated
- 2026-11-02
OSV
Remote code execution via file uploads in guest-entries
Guest Entries is a php library which allows users to create, update & delete entries from the front-end of a site. In affected versions the file uploads feature did not prevent the upload of PHP files. This may lead to code execution on the server by authenticated users. This vulnerability is fixed in v3.1.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2023-47621- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-434
- Updated
- 2026-11-02
OSVGHSA-rw82-mhmx-grmj
Guest Entries Remote code execution via file uploads
Impact
When using the file uploads feature, it was possible to upload PHP files.
Patches
The vulnerability is fixed in v3.1.2.
- Record
GHSA-rw82-mhmx-grmj- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-434
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
duncanmcclean/guest-entriesPackagist |
before 3.1.2 | 3.1.2 |
doublethreedigital/guest-entriesPackagist |
before 3.1.2 | 3.1.2 |
duncanmcclean/guest-entriesPackagist |
before 3.1.2, plus listed versions v1.0.0v1.0.1v1.0.2v1.0.3v1.0.4 Show 19 moreShow lessv1.0.5v1.0.6v1.0.7v1.0.8v1.1.0v1.1.1v1.2.0v1.2.1v1.2.2v1.2.3v2.0.0v2.0.1v2.1.0v2.1.1v2.1.2v2.1.3v3.0.0v3.1.0v3.1.1 |
3.1.2 |
doublethreedigital/guest-entriesPackagist |
before 3.1.2, plus listed versions v1.0.0v1.0.1v1.0.2v1.0.3v1.0.4 Show 19 moreShow lessv1.0.5v1.0.6v1.0.7v1.0.8v1.1.0v1.1.1v1.2.0v1.2.1v1.2.2v1.2.3v2.0.0v2.0.1v2.1.0v2.1.1v2.1.2v2.1.3v3.0.0v3.1.0v3.1.1 |
3.1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-47621 is a high vulnerability (CVSS 8.8) in Duncanmcclean Guest-entries, published November 13, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.02%, the 63rd percentile. Fixed in duncanmcclean/guest-entries 3.1.2.
References
github.com/duncanmcclean/guest-entries/security/advisories/GHSA-rw82-mhmx-grmj
nvd.nist.gov/vuln/detail/CVE-2023-47621