CVE-2023-37733
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
An arbitrary file upload vulnerability in tduck-platform v4.0 allows attackers to execute arbitrary code via a crafted HTML file.
Risk Assessment
The risk for the organization includes remote code execution, potentially leading to server compromise, data theft, or lateral movement within the internal network.
Recommendation
Immediately update tduck-platform to the latest version that fixes this vulnerability. Additionally, implement file type validation and restrict upload directory permissions.
Other vulnerabilities in tduck-platform
See all- CVE-2026-95829Medium
A vulnerability was identified in TDuckCloud tduck-platform up to 5.3. It affects the PaginationInnerInterceptor.concatOrderBy function in MybatisPlusConfig.java, where manipulation of the orders[0].column argument leads to SQL injection. The attack can be launched remotely and a public exploit is available.
- CVE-2026-90528Low
A flaw was found in TDuckApp tduck-platform up to version 5.3. It affects an unknown functionality in tduck-front/src/views/form/write/index.vue of the Form Write View component, where manipulation of the submitShowCustomPageContent argument causes cross site scripting (XSS). The attack can be carried out remotely, and the project was informed early via an issue report but has not responded.
Original NVD description (English source)
An arbitrary file upload vulnerability in tduck-platform v4.0 allows attackers to execute arbitrary code via a crafted HTML file.