CVE-2023-30185

CriticalCVSS 9.8

Published: 08/05/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.11%

62th percentile - higher than 62% of all known CVEs

Summary

CRMEB versions 4.4 to 4.6 were found to have an arbitrary file upload vulnerability. The flaw resides in the \attachment\SystemAttachmentServices.php component.

Risk Assessment

An attacker can upload a malicious file to the server, potentially leading to remote code execution, system compromise, or data theft.

Recommendation

Immediately update CRMEB to the latest available version that fixes this vulnerability. If an update is not possible, restrict access to the file upload component.

Original NVD description (English source)

CRMEB v4.4 to v4.6 was discovered to contain an arbitrary file upload vulnerability via the component \attachment\SystemAttachmentServices.php.