CVE-2023-24068

Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to modify conversation attachments within the attachments.noindex directory. Client mechanisms fail to validate modifications of existing cached files, resulting in an attacker's ability to insert malicious code into pre-existing attachments or replace them completely. A threat actor can forward the existing attachment in the corresponding conversation to external groups, and the name and size of the file will not change, allowing the malware to masquerade as another file. NOTE: the vendor disputes the relevance of this finding because the product is not intended to protect against adversaries with this degree of local access.

• https://johnjhacking.com/blog/cve-2023-24068-cve-2023-24069/Exploit, Third Party Advisory
• https://signal.org/download/linuxVendor Advisory
• https://signal.org/download/macosVendor Advisory
• https://signal.org/en/download/windowsVendor Advisory
• https://johnjhacking.com/blog/cve-2023-24068-cve-2023-24069/Exploit, Third Party Advisory
• https://signal.org/download/linuxVendor Advisory
• https://signal.org/download/macosVendor Advisory
• https://signal.org/en/download/windowsVendor Advisory

Published

Jan 23, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-2406The Event Registration Calendar By vcita plugin, versions up…5.4
• CVE-2023-24060Haven 5d15944 allows Server-Side Request Forgery (SSRF) via …5
• CVE-2023-24062Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR…6.8
• CVE-2023-24063Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR…6.8
• CVE-2023-24064Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR…6.8
• CVE-2023-24065NOSH 4a5cfdb allows stored XSS via the create user page. For…5.4
• CVE-2023-24069Signal Desktop before 6.2.0 on Windows, Linux, and macOS all…3.3
• CVE-2023-2407The Event Registration Calendar By vcita plugin, versions up…6.5
• CVE-2023-24070app/View/AuthKeys/authkey_display.ctp in MISP through 2.4.16…6.1
• CVE-2023-24078Real Time Logic FuguHub v8.1 and earlier was discovered to c…8.8
• CVE-2023-2408A vulnerability, which was classified as critical, has been …6.5
• CVE-2023-24080A lack of rate limiting on the password reset endpoint of Ch…9.8