CVE-2023-38708

    Dashboard / Vulnerabilities / CVE-2023-38708

    CVE-2023-38708

    Published: 4 Aug 2023Last Modified: 12 Aug 2026

    Summary: Pimcore Path Traversal Vulnerability in AssetController:importServerFilesAction

    Details: Pimcore is an Open Source Data & Experience Management Platform: PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce. A path traversal vulnerability exists in the `AssetController::importServerFilesAction`, which allows an attacker to overwrite or modify sensitive files by manipulating the pimcore_log parameter.This can lead to potential denial of service---key file overwrite. The impact of this vulnerability allows attackers to: overwrite or modify sensitive files, potentially leading to unauthorized access, privilege escalation, or disclosure of confidential information. This could also cause a denial of service (DoS) if critical system files are overwritten or deleted.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38708.json, https://github.com/pimcore/pimcore/security/advisories/GHSA-34hj-v8fm-x887, https://nvd.nist.gov/vuln/detail/CVE-2023-38708, https://github.com/pimcore/pimcore/commit/58012d0e3b8b926fb54eccbd64ec5c993b30c22c

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -194e370ca7529e3f0ff9ea55d51f023ed2f7e449

    Affected versions

    v10.6.6
    v10.6.5
    v10.6.4
    v10.6.3
    v10.6.2
    v10.6.1
    v10.6.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-38708 | CVE-DB