CVE-2023-43662

🗓️ 28 Sep 2023 21:54:44Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 2560 Views🌐 WEB

ShokoServer media server allows unauthenticated arbitrary file read via `/api/Image/WithPath` endpoint

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2023-43662	29 Sep 202302:37	–	circl
CNNVD	ShokoServer Path Traversal Vulnerability	28 Sep 202300:00	–	cnnvd
Cvelist	CVE-2023-43662 Arbitrary file read vulnerability in Shoko Server	28 Sep 202321:54	–	cvelist
Nuclei	ShokoServer System - Local File Inclusion (LFI)	28 Sep 202602:13	–	nuclei
NVD	CVE-2023-43662	28 Sep 202322:15	–	nvd
OpenVAS	Generic HTTP Directory Traversal / File Inclusion (Web Dirs) - Active Check	22 Jul 202100:00	–	openvas
Prion	Authentication flaw	28 Sep 202322:15	–	prion
Positive Technologies	PT-2023-28907 · Unknown · Shokoserver	28 Sep 202300:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2023-43662: Improper Limitation of a Pathname to a Restricted Directory	28 Sep 202300:00	–	rapid7
RedhatCVE	CVE-2023-43662	23 May 202504:24	–	redhatcve

NVD

Vulners

Node

shokoanime shokoserverRange≤4.2.2

[
  {
    "vendor": "ShokoAnime",
    "product": "ShokoServer",
    "versions": [
      {
        "version": "<= 4.2.2",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/ShokoAnime/ShokoServer/security/advisories/GHSA-mwcv-ghjq-8f2g
github	www.github.com/ShokoAnime/ShokoServer/commit/6c57ba0f073d6be5a4f508c46c2ce36727cbce80

Parameter	Position	Path	Description	CWE
serverImagePath	query param	/api/Image/WithPath	Unsecured /api/Image/WithPath endpoint accepts unsanitized serverImagePath and passes it to System.IO.File.OpenRead, enabling arbitrary file read without authentication.	CWE-22

17 Jun 2026 06:26Current

8.6High risk

Vulners AI Score8.6

CVSS 3.18.6

EPSS0.08147

SSVC

CWE-22