CVE-2023-46474

HighCVSS 7.2

Published: 11/01/2024(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

21.03%

97th percentile - higher than 97% of all known CVEs

Summary

A file upload vulnerability in PMB version 7.4.8 allows a remote attacker to execute arbitrary code and escalate privileges by uploading a crafted PHP file to the start_import.php script.

Risk Assessment

An attacker can take over the server, steal data, or install malware, compromising the confidentiality, integrity, and availability of the system.

Recommendation

Immediately update PMB to the latest version and implement file type validation and upload directory permission restrictions.

Original NVD description (English source)

File Upload vulnerability PMB v.7.4.8 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted PHP file uploaded to the start_import.php file.