CVE-2023-36460
CriticalCVSS 9.9Exploitation Probability (EPSS)
Very high risk98th percentile - higher than 98% of all known CVEs
Summary
Mastodon, an ActivityPub-based social network server, has a vulnerability that allows attackers to create and overwrite arbitrary files in the system through carefully crafted media files. This affects versions from 3.5.0 to 3.5.8 and 4.0.0 to 4.1.2.
Risk Assessment
This vulnerability can lead to denial of service and arbitrary remote code execution, posing a serious threat to the security of the system and user data.
Recommendation
It is recommended to upgrade to versions 3.5.9, 4.0.5, or 4.1.3, which contain patches that address this vulnerability.
Original NVD description (English source)
Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 3.5.0 and prior to versions 3.5.9, 4.0.5, and 4.1.3, attackers using carefully crafted media files can cause Mastodon's media processing code to create arbitrary files at any location. This allows attackers to create and overwrite any file Mastodon has access to, allowing Denial of Service and arbitrary Remote Code Execution. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue.