TI-2023-06145 Aliases CVE-2023-6723 GHSA-qhj9-jqq3-357q

Unrestricted Upload of File with Dangerous Type in Repox

MEDIUM 50CWE-434Published 2023-12-13 · Updated 2025-05-22

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

An unrestricted file upload vulnerability has been identified in Repbox, which allows an attacker to upload malicious files via the transforamationfileupload function, due to the lack of proper file type validation controls, resulting in a full system compromise.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0078 56th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Repox	Repox	up to 2.3.7	—	No fix listed	CNA

Repox VendorRepox Affected up to 2.3.7 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:europeana:repox:2.3.7:::::::*	2.3.7	Vulnerable	Repox

cpe:2.3:a:europeana:repox:2.3.7:*:*:*:*:*:*:* Versions 2.3.7 Vulnerable ·Repox

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2023-6723
2026-10-03 Alias added: GHSA-qhj9-jqq3-357q

References

Advisory 1

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-repox

TI-2023-06140 Authentication Bypass Using an Alternate Path or Channel in Repox CVSS 3.1CRITICAL 9.4
TI-2023-06143 Improper Restriction of XML External Entity Reference in Repox CVSS 3.1HIGH 8.3
TI-2023-06144 Relative Path Traversal in Repox CVSS 3.1HIGH 7.5
TI-2023-06141 Cross-site Scripting in Repox CVSS 3.1MEDIUM 6.3
TI-2023-06142 Cross-site Scripting in Repox CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences