CVE-2023-46865

2023-10-3001:15:21

Google

osv.dev

cve-2023-46865

php code execution

image upload

7.9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

31.2%

JSON

/api/v1/company/upload-logo in CompanyController.php in crater through 6.0.6 allows a superadmin to execute arbitrary PHP code by placing this code into an image/png IDAT chunk of a Company Logo image.

CPENameOperatorVersion
cratereq6.0.2
cratereq6.0.6
cratereq4.0.2
cratereq2.0.2
cratereq5.0.2
cratereq4.2.0
cratereq4.0.1
cratereq5.0.0
cratereq1.1.0
cratereq6.0.0