CVE-2023-24069

Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to obtain potentially sensitive attachments sent in messages from the attachments.noindex directory. Cached attachments are not effectively cleared. In some cases, even after a self-initiated file deletion, an attacker can still recover the file if it was previously replied to in a conversation. (Local filesystem access is needed by the attacker.) NOTE: the vendor disputes the relevance of this finding because the product is not intended to protect against adversaries with this degree of local access.

• CWE-200

• https://johnjhacking.com/blog/cve-2023-24068-cve-2023-24069/Exploit, Third Party Advisory
• https://signal.org/download/linuxProduct, Vendor Advisory
• https://signal.org/download/macosProduct, Vendor Advisory
• https://signal.org/en/download/windowsProduct, Vendor Advisory
• https://johnjhacking.com/blog/cve-2023-24068-cve-2023-24069/Exploit, Third Party Advisory
• https://signal.org/download/linuxProduct, Vendor Advisory
• https://signal.org/download/macosProduct, Vendor Advisory
• https://signal.org/en/download/windowsProduct, Vendor Advisory

Published

Jan 23, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-24060Haven 5d15944 allows Server-Side Request Forgery (SSRF) via …5
• CVE-2023-24062Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR…6.8
• CVE-2023-24063Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR…6.8
• CVE-2023-24064Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR…6.8
• CVE-2023-24065NOSH 4a5cfdb allows stored XSS via the create user page. For…5.4
• CVE-2023-24068Signal Desktop before 6.2.0 on Windows, Linux, and macOS all…7.8
• CVE-2023-2407The Event Registration Calendar By vcita plugin, versions up…6.5
• CVE-2023-24070app/View/AuthKeys/authkey_display.ctp in MISP through 2.4.16…6.1
• CVE-2023-24078Real Time Logic FuguHub v8.1 and earlier was discovered to c…8.8
• CVE-2023-2408A vulnerability, which was classified as critical, has been …6.5
• CVE-2023-24080A lack of rate limiting on the password reset endpoint of Ch…9.8
• CVE-2023-24081Multiple stored cross-site scripting (XSS) vulnerabilities i…5.4