CVE-2023-37733

MediumCVSS 6.1

Published: 19/07/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.43%

34th percentile - higher than 34% of all known CVEs

Summary

An arbitrary file upload vulnerability in tduck-platform v4.0 allows attackers to execute arbitrary code via a crafted HTML file.

Risk Assessment

The risk for the organization includes remote code execution, potentially leading to server compromise, data theft, or lateral movement within the internal network.

Recommendation

Immediately update tduck-platform to the latest version that fixes this vulnerability. Additionally, implement file type validation and restrict upload directory permissions.

Original NVD description (English source)

An arbitrary file upload vulnerability in tduck-platform v4.0 allows attackers to execute arbitrary code via a crafted HTML file.