{"id":"CVE-2023-47268","aliases":["DEBIAN-CVE-2023-47268","EUVD-2023-51398","GHSA-xqpp-8rwp-6rcr","UBUNTU-CVE-2023-47268"],"status":"published","title":"In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer through 2.6.1, a crafted 3mf project...","description":"In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer through 2.6.1, a crafted 3mf project file can execute arbitrary code on a host where the project is sliced and G-code exported.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.0072,"percentile":0.54359,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-77"],"published":"2026-05-08T00:00:00Z","modified":"2026-10-30T02:31:04Z","exploits":[{"source":"pocgithub","id":"Pallangyo98/Trickster-HTB","title":"Pallangyo98/Trickster-HTB","date":"2025-02-19","url":"https://github.com/Pallangyo98/Trickster-HTB"},{"source":"pocgithub","id":"suce0155/CVE-2023-47268","title":"suce0155/CVE-2023-47268","date":"2024-09-26","url":"https://github.com/suce0155/CVE-2023-47268"}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"slic3r-prusa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.0+dfsg-4","2.5.2+dfsg-1","2.6.0+dfsg-1","2.6.0+dfsg-2","2.6.0+dfsg-3","2.6.1+dfsg-1","2.6.1+dfsg-2","2.6.1+dfsg-3","2.6.1+dfsg-4","2.6.1+dfsg-4.1","2.7.1+dfsg-1","2.7.2+dfsg-1","2.7.4+dfsg-1","2.7.4+dfsg-1.1","2.7.5~rc1+dfsg-1","2.8.0+dfsg-1","2.8.1+dfsg2-1","2.8.1+dfsg2-2","2.9.0+dfsg-1","2.9.1+dfsg-1","2.9.2+dfsg-1","2.9.2+dfsg-2","2.9.3+dfsg-1","2.9.3+dfsg-2","2.9.4+dfsg-1","2.9.4+dfsg-2","2.9.4+dfsg-3","2.9.4+dfsg-4","2.9.5+dfsg-1","2.9.6+dfsg-1","2.9.6+dfsg-2"]},{"source":"osv","ecosystem":"Debian:13","package":"slic3r-prusa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.9.2+dfsg-1","2.9.2+dfsg-2","2.9.3+dfsg-1","2.9.3+dfsg-2","2.9.4+dfsg-1","2.9.4+dfsg-2","2.9.4+dfsg-3","2.9.4+dfsg-4","2.9.5+dfsg-1","2.9.6+dfsg-1","2.9.6+dfsg-2"]},{"source":"osv","ecosystem":"Debian:14","package":"slic3r-prusa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.9.2+dfsg-1","2.9.2+dfsg-2","2.9.3+dfsg-1","2.9.3+dfsg-2","2.9.4+dfsg-1","2.9.4+dfsg-2","2.9.4+dfsg-3","2.9.4+dfsg-4","2.9.5+dfsg-1","2.9.6+dfsg-1","2.9.6+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"slic3r-prusa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.37.0+dfsg-1.1","1.37.0+dfsg-1.1build1","1.38.0+dfsg-1","1.39.0+dfsg-1","1.39.1+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"slic3r-prusa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.39.2+dfsg-1build3","1.39.2+dfsg-1build4","2.1.1+dfsg-1","2.1.1+dfsg-2","2.1.1+dfsg-2build1","2.1.1+dfsg-2build2","2.1.1+dfsg-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"slic3r-prusa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.1+dfsg-1","2.4.0+dfsg-1","2.4.0+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"slic3r-prusa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.2+dfsg-1","2.7.2+dfsg-1build1","2.7.2+dfsg-1build2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"slic3r-prusa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.9.4+dfsg-4","2.9.6+dfsg-1","2.9.6+dfsg-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"slic3r-prusa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.9.2+dfsg-1","2.9.4+dfsg-2ubuntu1","2.9.4+dfsg-4"]}],"products":[{"vendor":"prusa3d","product":"prusaslicer"}],"references":[{"url":"https://help.prusa3d.com/article/post-processing-scripts_283913","tags":["Product","web"]},{"url":"https://www.prusa3d.com/page/prusaslicer_424/","tags":["Product","web"]},{"url":"https://slic3r.org/download/","tags":["Not Applicable","web"]},{"url":"https://raw.githubusercontent.com/vulncheck-oss/0day.today.archive/main/local-exploits/39547.txt","tags":["exploit","Exploit","Third Party Advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-47268","tags":["advisory"]},{"url":"https://slic3r.org/download"},{"url":"https://www.prusa3d.com/page/prusaslicer_424"},{"url":"https://github.com/advisories/GHSA-xqpp-8rwp-6rcr"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/47xxx/CVE-2023-47268.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-47268","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-47268","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-47268","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-47268","description":"In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer through 2.6.1, a crafted 3mf project file can execute arbitrary code on a host where the project is sliced and G-code exported.","status":"published","published":"2026-05-08T00:00:00Z","modified":"2026-05-08T17:07:37.996Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:35:14.298866Z"}],"euvd":[{"id":"EUVD-2023-51398","description":"In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer through 2.6.1, a crafted 3mf project file can execute arbitrary code on a host where the project is sliced and G-code exported.","status":"published","published":"2026-05-08T00:00:00Z","modified":"2026-05-08T17:07:37Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T19:05:14.505765Z"}],"ghsa":[{"id":"GHSA-xqpp-8rwp-6rcr","title":"In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer through 2.6.1, a crafted 3mf project...","description":"In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer through 2.6.1, a crafted 3mf project file can execute arbitrary code on a host where the project is sliced and G-code exported.","status":"published","published":"2026-05-08T06:32:38Z","modified":"2026-05-08T18:31:32Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:07:57.635262Z"}],"nvd":[{"id":"CVE-2023-47268","description":"In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer through 2.6.1, a crafted 3mf project file can execute arbitrary code on a host where the project is sliced and G-code exported.","status":"published","published":"2026-05-08T06:16:08.667Z","modified":"2026-10-28T19:10:00.193Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:09:27.733183Z"}],"osv":[{"id":"CVE-2023-47268","description":"In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer through 2.6.1, a crafted 3mf project file can execute arbitrary code on a host where the project is sliced and G-code exported.","status":"published","published":"2026-05-08T00:00:00Z","modified":"2026-10-30T02:31:04.135909068Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:34.287121Z"},{"id":"DEBIAN-CVE-2023-47268","description":"In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer through 2.6.1, a crafted 3mf project file can execute arbitrary code on a host where the project is sliced and G-code exported.","status":"published","published":"2026-05-08T06:16:08.667Z","modified":"2026-10-29T09:47:27.543142674Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"UBUNTU-CVE-2023-47268","description":"In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer through 2.6.1, a crafted 3mf project file can execute arbitrary code on a host where the project is sliced and G-code exported.","status":"published","published":"2026-05-08T06:16:00Z","modified":"2026-10-28T20:15:38.042981025Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:54:23.935133Z"}]}}