CVE-2023-1105
📛 CVE Title
External Control of File Name or Path in flatpressblog/flatpress
Description
External Control of File Name or Path in GitHub repository flatpressblog/flatpress prior to 1.3.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- @huntrdev
- CVSS severity
- HIGH
- CVSS score
- 7.5 / 10
- CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N- Effective score
- 7.5 / 10 HIGH source: CNA overview
- CWE(s)
-
CWE-73 - Reserved
- 2023-03-01
- Published
- 2023-03-01 01:00 UTC
- Last updated
- 2025-03-11 15:15 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/1xxx/CVE-2023-1105.json
- Linked Threat
- CVE-2023-1105 — External Control of File Name or Path in flatpressblog/flatpress
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2023-23392 - Assigner
- @huntrdev
- Published
- Mar 1, 2023, 12:00:00 AM
- Updated
- Mar 11, 2025, 2:15:57 PM
- EUVD base score (CVSS 3.0)
-
7.5 / 10
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - EUVD-reported EPSS
- 0.2600
- Vendors
- flatpressblog
- Products
-
flatpressblog/flatpress (unspecified <1.3)
- Aliases
-
GHSA-2qf9-qchx-rh67
ENISA description: External Control of File Name or Path in GitHub repository flatpressblog/flatpress prior to 1.3.
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| flatpressblog | flatpressblog/flatpress |
unspecified (affected)
|
— |
Vendor references (2)
References embedded in the original CVE record by the assigning CNA.
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
Remediations (13)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:access.redhat.com
Learn about our open source products, services, and company. You are here
2026-06-02 14:27 UTC -
web:support.servicenow.com
Overview The advisories below document publicly disclosed Common Vulnerabilities and Exposures ( CVEs ) in the Now Platform by ServiceNow. Because ServiceNow uses various methods to communicate vulnerability information, patches, and other fixes, customers should review family, security patch , and hotfix release notes, which are available at https://docs.servicenow.com, for a complete list of ...
2026-06-02 14:27 UTC -
web:www.tenable.com
Microsoft patched 57 CVEs in its November 2023 Patch Tuesday release, with three rated critical and 54 rated important. We omitted one vulnerability from our counts this month, CVE - 2023 -24023, a Bluetooth Vulnerability as this flaw was reported through MITRE.
2026-06-02 14:27 UTC -
web:github.com
Patch termsrv.dll so that multiple remote users can open an RDP session on a non-Windows Server computer - fabianosrc/TermsrvPatcher
2026-05-22 05:36 UTC -
web:nvd.nist.gov
The NVD is the U.S. government repository of standards based vulnerability management data represented using the Security Content Automation Protocol (SCAP). This data enables automation of vulnerability management, security measurement, and compliance. The NVD includes databases of security checklist references, security-related software flaws, product names, and impact metrics. For ...
2026-05-22 05:36 UTC -
web:portal.msrc.microsoft.com
The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.
2026-05-22 05:36 UTC -
web:www.tomsguide.com
November's Patch Tuesday updates fix 63 flaws in total but two of them are critical vulnerabilities that require your immediate attention.
2026-05-22 05:36 UTC -
web:www.crowdstrike.com
Microsoft has released security updates for 63 vulnerabilities, including 1 zero-day and 4 critical vulnerabilities, in its November 2025 Patch Tuesday rollout.
2026-05-22 05:36 UTC -
web:www.cve.org
At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures
2026-05-22 05:36 UTC -
web:www.notebookcheck.net
Microsoft confirmed that its April 2026 security updates, including KB5082063 and KB5083769, are triggering BitLocker recovery prompts on some Windows Server 2025, Windows 11, and Windows 10 devices.
2026-05-22 05:36 UTC -
web:www.oracle.com
This Critical Patch Update contains 374 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at October 2025 Critical Patch Update: Executive Summary and Analysis.
2026-05-22 05:36 UTC -
web:attack.mitre.org
This mitigation can be implemented through the following measures: Regular Operating System Updates Implementation: Apply the latest Windows security updates monthly using WSUS (Windows Server Update Services) or a similar patch management solution. Configure systems to check for updates automatically and schedule reboots during maintenance ...
2026-05-22 05:36 UTC -
web:cybersecuritynews.com
No patch has been released yet; Microsoft has instead issued a multi-step manual mitigation guide while a formal security update is prepared. Windows BitLocker Security Bypass The vulnerability originates in WinRE's handling of the BootExecute registry value under HKLM\ControlSet001\Control\Session Manager.
2026-05-22 05:36 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2023-1105.json.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T05:32:46.384Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/flatpressblog/flatpress/commit/5d5c7f6d8f072d14926fc2c3a97cdd763802f170"
},
{
"tags": [
"x_transferred"
],
"url": "https://huntr.dev/bounties/4089a63f-cffd-42f3-b8d8-e80b6bd9c80f"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-1105",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-11T14:15:51.323417Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-11T14:15:57.436Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "flatpressblog/flatpress",
"vendor": "flatpressblog",
"versions": [
{
"lessThan": "1.3",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "External Control of File Name or Path in GitHub repository flatpressblog/flatpress prior to 1.3."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "CWE-73 External Control of File Name or Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-03-01T00:00:00.000Z",
"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"shortName": "@huntrdev"
},
"references": [
{
"url": "https://github.com/flatpressblog/flatpress/commit/5d5c7f6d8f072d14926fc2c3a97cdd763802f170"
},
{
"url": "https://huntr.dev/bounties/4089a63f-cffd-42f3-b8d8-e80b6bd9c80f"
}
],
"source": {
"advisory": "4089a63f-cffd-42f3-b8d8-e80b6bd9c80f",
"discovery": "EXTERNAL"
},
"title": "External Control of File Name or Path in flatpressblog/flatpress"
}
},
"cveMetadata": {
"assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"assignerShortName": "@huntrdev",
"cveId": "CVE-2023-1105",
"datePublished": "2023-03-01T00:00:00.000Z",
"dateReserved": "2023-03-01T00:00:00.000Z",
"dateUpdated": "2025-03-11T14:15:57.436Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}