CVE-2023-38950

A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated...

7.5 HighIn KEV

A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload. This vulnerability was fixed in version 9.0.120240617.19506 of ZKBioTime.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

92.5%Up 92.4 points since Aug 4, 2023

What each source reports

NVD Score used 7.5

Record: CVE-2023-38950
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-22
Updated: 2026-11-02

CVE List 7.5

Record: CVE-2023-38950
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-22
Updated: 2026-11-02

EUVDEUVD-2023-42710 7.5

Record: EUVD-2023-42710
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-27mv-5vpc-8g53 7.5

A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated...

A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload.

Record: GHSA-27mv-5vpc-8g53
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-22
Updated: 2026-11-02

CISA KEV No score

ZKTeco BioTime Path Traversal Vulnerability

ZKTeco BioTime contains a path traversal vulnerability in the iclock API that allows an unauthenticated attacker to read arbitrary files via supplying a crafted payload.

Record: CVE-2023-38950
Weakness: CWE-22
Updated: 2026-11-02

Affected products

zkteco biotime

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Nuclei	ZKTeco BioTime v8.5.5 - Path Traversal

History

History
Recorded	Changed	Sources
Nov 3, 2026	exploitation
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, CISA KEV, Nuclei, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-38950 is a high vulnerability (CVSS 7.5) in Zkteco Biotime, published August 3, 2023. CISA lists it as known to be exploited, since May 19, 2025. EUVD reports exploitation since May 19, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 92.5%, the 99th percentile. No source names a fixed version.