Lucene search

CVE-2023-22726

🗓️ 20 Jan 2023 22:10:15Reported by GitHub_MType

act project allows path traversal in /upload and /artifact endpoints, leading to remote code execution(CVE-2023-22726)

AI Insights are available for you today

Leverage the power of AI to quickly understand vulnerabilities, impacts, and exploitability

Reporter	Title	Published	Views	Family All 9
Cvelist	CVE-2023-22726 Unrestricted file upload leading to privilege escalation in act	20 Jan 202321:02	–	cvelist
OSV	GO-2023-1504 act vulnerable to arbitrary file upload in artifact server in github.com/nektos/act	20 Aug 202420:25	–	osv
OSV	act vulnerable to arbitrary file upload in artifact server	20 Jan 202316:00	–	osv
OSV	CVE-2023-22726	20 Jan 202322:15	–	osv
NVD	CVE-2023-22726	20 Jan 202322:15	–	nvd
Vulnrichment	CVE-2023-22726 Unrestricted file upload leading to privilege escalation in act	20 Jan 202321:02	–	vulnrichment
Prion	Path traversal	20 Jan 202322:15	–	prion
Veracode	Privilege Escalation	26 Jan 202315:55	–	veracode
Github Security Blog	act vulnerable to arbitrary file upload in artifact server	20 Jan 202316:00	–	github

Nvd

Vulners

Node

act_project actRange<0.2.40go

[
  {
    "vendor": "nektos",
    "product": "act",
    "versions": [
      {
        "version": "< 0.2.40",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/nektos/act/blob/master/pkg/artifacts/server.go
github	www.github.com/nektos/act/blob/v0.2.35/pkg/artifacts/server.go
github	www.github.com/nektos/act/blob/v0.2.35/pkg/artifacts/server.go
github	www.github.com/nektos/act/issues/1553
github	www.github.com/nektos/act/commit/63ae215071f94569d910964bdee866d91d6e3a10
securitylab	www.securitylab.github.com/advisories/GHSL-2023-004_act/
github	www.github.com/nektos/act/security/advisories/GHSA-pc99-qmg4-rcff

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

20 Jan 2023 22:15Current

8.2High risk

Vulners AI Score8.2

CVSS38 - 8.8

EPSS0.02046

SSVC