CVE-2023-36460

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-36460
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-36460.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-36460
Aliases
Published
2023-07-06T18:39:09.825Z
Modified
2026-02-12T01:10:01.155802Z
Severity
  • 9.9 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Mastodon vulnerable to arbitrary file creation through media attachments
Details

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 3.5.0 and prior to versions 3.5.9, 4.0.5, and 4.1.3, attackers using carefully crafted media files can cause Mastodon's media processing code to create arbitrary files at any location. This allows attackers to create and overwrite any file Mastodon has access to, allowing Denial of Service and arbitrary Remote Code Execution. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue.

Database specific 
{
    "cwe_ids": [
        "CWE-22"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36460.json"
}
References

Affected packages

Git / github.com/mastodon/mastodon

Affected ranges

Type
GIT
Repo
https://github.com/mastodon/mastodon
Events
Introduced
8c7223f4eac80b5725485be742d3fa2c984f4670
Fixed
b10c974ba1952c545acff505bfd36feb0c60b000
Database specific 
{
    "versions": [
        {
            "introduced": "3.5.0"
        },
        {
            "fixed": "3.5.9"
        }
    ]
}
Type
GIT
Repo
https://github.com/mastodon/mastodon
Events
Introduced
fb389bd73c8a4bc2924496f6041c8eee27572d21
Fixed
8d7f6550f91338fb69e5c6e0cd28653122784665
Database specific 
{
    "versions": [
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.0.5"
        }
    ]
}
Type
GIT
Repo
https://github.com/mastodon/mastodon
Events
Introduced
61c5dfb9295ea66c376c452a7ef7379e8c562416
Fixed
0d5781ca7609590a6d5340bb685bb1804056bb46
Database specific 
{
    "versions": [
        {
            "introduced": "4.1.0"
        },
        {
            "fixed": "4.1.3"
        }
    ]
}

Affected versions

v3.*
v3.5.0
v3.5.1
v3.5.2
v3.5.3
v3.5.4
v3.5.5
v3.5.6
v3.5.7
v3.5.8
v4.*
v4.0.0
v4.0.1
v4.0.2
v4.0.3
v4.0.4
v4.1.0
v4.1.1
v4.1.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-36460.json"