{"id":"CVE-2023-52262","aliases":["EUVD-2023-56935","GHSA-rq2j-cfp8-w8c7"],"status":"published","title":"outdoorbits little-backup-box (aka Little Backup Box) before f39f91c allows remote attackers to...","description":"outdoorbits little-backup-box (aka Little Backup Box) before f39f91c allows remote attackers to execute arbitrary code because the PHP extract function is used for untrusted input.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00926,"percentile":0.60734,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2023-12-30T00:00:00Z","modified":"2026-10-28T02:30:48Z","products":[{"vendor":"outdoorbits","product":"little_backup_box"}],"references":[{"url":"https://github.com/outdoorbits/little-backup-box/commit/f39f91cd05544b3eb18b59897c765d6ba9313faa","tags":["x_transferred","Patch","fix"]},{"url":"https://www.php.net/manual/en/function.extract","tags":["x_transferred","Product","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52262","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rq2j-cfp8-w8c7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/52xxx/CVE-2023-52262.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-52262","description":"outdoorbits little-backup-box (aka Little Backup Box) before f39f91c allows remote attackers to execute arbitrary code because the PHP extract function is used for untrusted input.","status":"published","published":"2023-12-30T00:00:00Z","modified":"2024-08-02T22:55:41.559Z","updated_at":"2026-11-02T14:35:18.508816Z"}],"euvd":[{"id":"EUVD-2023-56935","description":"outdoorbits little-backup-box (aka Little Backup Box) before f39f91c allows remote attackers to execute arbitrary code because the PHP extract function is used for untrusted input.","status":"published","published":"2023-12-30T00:00:00Z","modified":"2024-08-02T22:55:41Z","updated_at":"2026-11-03T03:26:06.635969Z"}],"ghsa":[{"id":"GHSA-rq2j-cfp8-w8c7","title":"outdoorbits little-backup-box (aka Little Backup Box) before f39f91c allows remote attackers to...","description":"outdoorbits little-backup-box (aka Little Backup Box) before f39f91c allows remote attackers to execute arbitrary code because the PHP extract function is used for untrusted input.","status":"published","published":"2023-12-30T21:30:18Z","modified":"2024-01-09T21:30:28Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T14:55:22.936224Z"}],"nvd":[{"id":"CVE-2023-52262","description":"outdoorbits little-backup-box (aka Little Backup Box) before f39f91c allows remote attackers to execute arbitrary code because the PHP extract function is used for untrusted input.","status":"published","published":"2023-12-30T19:15:08.197Z","modified":"2026-06-17T06:42:23.013Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"updated_at":"2026-11-02T14:08:59.830468Z"}],"osv":[{"id":"CVE-2023-52262","description":"outdoorbits little-backup-box (aka Little Backup Box) before f39f91c allows remote attackers to execute arbitrary code because the PHP extract function is used for untrusted input.","status":"published","published":"2023-12-30T00:00:00Z","modified":"2026-10-28T02:30:48.858300605Z","updated_at":"2026-11-02T15:44:35.245372Z"}]}}