CVE-2023-26045 - CVE House
Back to Database
Status published Critical CVE-2023-26045

NodeBB vulnerable to path traversal and code execution via prototype vulnerability

Vulnerability Description

NodeBB is Node.js based forum software. Starting in version 2.5.0 and prior to version 2.8.7, due to the use of the object destructuring assignment syntax in the user export code path, combined with a path traversal vulnerability, a specially crafted payload could invoke the user export logic to arbitrarily execute javascript files on the local disk. This issue is patched in version 2.8.7. As a workaround, site maintainers can cherry pick the fix into their codebase to patch the exploit.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-26045

Credits & Attribution

No credits recorded in the NVD database.

References

More from NodeBB

View All →
CVE-2023-2850
NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due...
Medium 4.7
CVE-2022-46164
Account takeover via prototype vulnerability
Critical 9.4
CVE-2022-36076
Account takeover via SSO plugins in NodeBB
High 8.8
CVE-2022-36045
Account takeover via cryptographically weak PRNG in NodeBB Forum
Critical 9
CVE-2021-47746
NodeBB Plugin Emoji 3.2.1 - Arbitrary File Write
High 8.6

Affected Vendor

Affected Software

NodeBB
Vulnerable Versions:
>= 2.5.0, < 2.8.7

Timeline

Official Publish: July 24th, 2023
Last Modified: February 13th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-22

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1565.001 Stored Data Manipulation
Impact