CVE-2023-31541

CriticalCVSS 9.8

Published: 13/06/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.42%

70th percentile - higher than 70% of all known CVEs

Summary

The CKEditor v1.2.3 plugin for Redmine has an unrestricted file upload vulnerability in the 'Browse and upload images' feature, allowing arbitrary files to be uploaded to the server.

Risk Assessment

An attacker can upload malicious files (e.g., PHP scripts) to the server, potentially leading to remote code execution, server compromise, or data theft.

Recommendation

Immediately update the CKEditor plugin to the latest version and implement file type validation and size restrictions for uploaded files.

Original NVD description (English source)

A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’ feature of the CKEditor v1.2.3 plugin for Redmine, which allows arbitrary files to be uploaded to the server.