{"id":"CVE-2023-2868","aliases":["EUVD-2023-34316","GHSA-898g-hmh5-hrcr"],"status":"published","title":"Remote Code injection in Barracuda Email Security Gateway","description":"A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives). The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl's qx operator with the privileges of the Email Security Gateway product. This issue was fixed as part of BNSF-36456 patch. This patch was automatically applied to all customer appliances.","severity":{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.86841,"percentile":0.99749,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-20","CWE-77"],"published":"2023-05-24T18:00:52Z","modified":"2026-06-17T05:53:39Z","kev":{"date_added":"2023-05-26","due_date":"2023-06-16","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2023-05-26"},{"source":"kev","since":"2023-05-26"}],"exploits":[{"source":"metasploit","id":"exploit/linux/smtp/barracuda_esg_tarfile_rce","title":"Barracuda ESG TAR Filename Command Injection","type":"exploit","platform":"Unix","date":"2023-05-23","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/smtp/barracuda_esg_tarfile_rce"},{"source":"pocgithub","id":"cfielding-r7/poc-cve-2023-2868","title":"cfielding-r7/poc-cve-2023-2868","date":"2023-06-20","url":"https://github.com/cfielding-r7/poc-cve-2023-2868"},{"source":"pocgithub","id":"cashapp323232/CVE-2023-2868CVE-2023-2868","title":"cashapp323232/CVE-2023-2868CVE-2023-2868","date":"2023-07-30","url":"https://github.com/cashapp323232/CVE-2023-2868CVE-2023-2868"},{"source":"pocgithub","id":"krmxd/CVE-2023-2868","title":"krmxd/CVE-2023-2868","date":"2023-08-25","url":"https://github.com/krmxd/CVE-2023-2868"}],"products":[{"vendor":"barracuda","product":"barracuda email security gateway"},{"vendor":"barracuda","product":"email_security_gateway_300_firmware"},{"vendor":"barracuda","product":"email_security_gateway_400_firmware"},{"vendor":"barracuda","product":"email_security_gateway_600_firmware"},{"vendor":"barracuda","product":"email_security_gateway_800_firmware"},{"vendor":"barracuda","product":"email_security_gateway_900_firmware"},{"vendor":"barracuda networks","product":"email security gateway (esg) appliance"}],"references":[{"url":"https://www.barracuda.com/company/legal/esg-vulnerability","tags":["x_transferred","Mitigation","Vendor Advisory"]},{"url":"https://status.barracuda.com/incidents/34kx82j5n4q9","tags":["x_transferred","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-2868","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-2868"},{"url":"https://github.com/advisories/GHSA-898g-hmh5-hrcr"}],"sources":{"cve":[{"id":"CVE-2023-2868","title":"Remote Code injection in Barracuda Email Security Gateway","description":"A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives). The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl's qx operator with the privileges of the Email Security Gateway product. This issue was fixed as part of BNSF-36456 patch. This patch was automatically applied to all customer appliances.","status":"published","published":"2023-05-24T18:00:52.36Z","modified":"2025-10-21T23:05:47.195Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:35:24.004321Z"}],"euvd":[{"id":"EUVD-2023-34316","description":"A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives). The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl's qx operator with the privileges of the Email Security Gateway product. This issue was fixed as part of BNSF-36456 patch. This patch was automatically applied to all customer appliances.","status":"published","published":"2023-05-24T18:00:52Z","modified":"2025-10-21T23:05:47Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical"}],"exploited_since":"2023-05-26","updated_at":"2026-11-02T20:31:27.312976Z"}],"ghsa":[{"id":"GHSA-898g-hmh5-hrcr","title":"A remote command injection vulnerability exists in the Barracuda Email Security Gateway ...","description":"A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives). The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl's qx operator with the privileges of the Email Security Gateway product. This issue was fixed as part of BNSF-36456 patch. This patch was automatically applied to all customer appliances.","status":"published","published":"2023-07-06T21:15:05Z","modified":"2025-10-22T00:33:51Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical"}],"cwes":["CWE-20","CWE-77"],"updated_at":"2026-11-02T15:04:08.734574Z"}],"kev":[{"id":"CVE-2023-2868","title":"Barracuda Networks ESG Appliance Improper Input Validation Vulnerability","description":"Barracuda Email Security Gateway (ESG) appliance contains an improper input validation vulnerability of a user-supplied .tar file, leading to remote command injection.","cwes":["CWE-20"],"kev":{"date_added":"2023-05-26","due_date":"2023-06-16","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2023-2868","description":"A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives). The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl's qx operator with the privileges of the Email Security Gateway product. This issue was fixed as part of BNSF-36456 patch. This patch was automatically applied to all customer appliances.","status":"published","published":"2023-05-24T19:15:09.363Z","modified":"2026-06-17T05:53:39.77Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-20","CWE-77"],"updated_at":"2026-11-02T14:08:03.200773Z"}]}}