CVE-2023-37602

MediumCVSS 6.1

Published: 20/07/2023(UTC)Updated: 17/06/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.59%

44th percentile - higher than 44% of all known CVEs

Summary

Alkacon OpenCMS version 15.0 has an arbitrary file upload vulnerability in the /workplace#!explorer component that allows attackers to execute arbitrary code by uploading a crafted PNG file.

Risk Assessment

This vulnerability could lead to remote code execution, posing a significant threat to the security of the system and the organization's data.

Recommendation

It is recommended to update to the latest version of Alkacon OpenCMS and implement appropriate security measures to prevent unauthorized file uploads.

Original NVD description (English source)

An arbitrary file upload vulnerability in the component /workplace#!explorer of Alkacon OpenCMS v15.0 allows attackers to execute arbitrary code via uploading a crafted PNG file.