{"id":"CVE-2023-41788","aliases":["EUVD-2023-46280","GHSA-43vm-xh53-958r"],"status":"published","title":"Remote Code Execution via File Uploader","description":"Unrestricted Upload of File with Dangerous Type vulnerability in Pandora FMS on all allows Accessing Functionality Not Properly Constrained by ACLs. This vulnerability allows attackers to execute code via PHP file uploads. This issue affects Pandora FMS: from 700 through 773.","severity":{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00717,"percentile":0.54126,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-434"],"published":"2023-11-23T14:33:44Z","modified":"2026-06-17T06:22:48Z","products":[{"vendor":"artica","product":"pandora_fms"},{"vendor":"pandora fms","product":"pandora fms"}],"references":[{"url":"https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/","tags":["vendor-advisory","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-41788"},{"url":"https://github.com/advisories/GHSA-43vm-xh53-958r"}],"sources":{"cve":[{"id":"CVE-2023-41788","title":"Remote Code Execution via File Uploader","description":"Unrestricted Upload of File with Dangerous Type vulnerability in Pandora FMS on all allows Accessing Functionality Not Properly Constrained by ACLs. This vulnerability allows attackers to execute code via PHP file uploads. This issue affects Pandora FMS: from 700 through 773.","status":"published","published":"2023-11-23T14:33:44.933Z","modified":"2024-08-02T19:09:48.378Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:35:19.217111Z"}],"euvd":[{"id":"EUVD-2023-46280","description":"Unrestricted Upload of File with Dangerous Type vulnerability in Pandora FMS on all allows Accessing Functionality Not Properly Constrained by ACLs. This vulnerability allows attackers to execute code via PHP file uploads. This issue affects Pandora FMS: from 700 through 773.","status":"published","published":"2023-11-23T14:33:44Z","modified":"2024-08-02T19:09:48Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T03:50:01.043754Z"}],"ghsa":[{"id":"GHSA-43vm-xh53-958r","title":"Unrestricted Upload of File with Dangerous Type vulnerability in Pandora FMS on all allows...","description":"Unrestricted Upload of File with Dangerous Type vulnerability in Pandora FMS on all allows Accessing Functionality Not Properly Constrained by ACLs. This vulnerability allows attackers to execute code via PHP file uploads. This issue affects Pandora FMS: from 700 through 773.","status":"published","published":"2023-11-23T15:30:26Z","modified":"2023-11-23T15:30:26Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:55:05.78804Z"}],"nvd":[{"id":"CVE-2023-41788","description":"Unrestricted Upload of File with Dangerous Type vulnerability in Pandora FMS on all allows Accessing Functionality Not Properly Constrained by ACLs. This vulnerability allows attackers to execute code via PHP file uploads. This issue affects Pandora FMS: from 700 through 773.","status":"published","published":"2023-11-23T15:15:08.407Z","modified":"2026-06-17T06:22:48.897Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:08:49.393375Z"}]}}