CVE-2023-26045

NodeBB is Node.js based forum software. Starting in version 2.5.0 and prior to version 2.8.7, due to the use of the object destructuring assignment syntax in the user export code path, combined with a path traversal vulnerability, a specially crafted payload could invoke the user export logic to arbitrarily execute javascript files on the local disk. This issue is patched in version 2.8.7. As a workaround, site maintainers can cherry pick the fix into their codebase to patch the exploit.

• CWE-22

• https://github.com/NodeBB/NodeBB/commit/ec58700f6dff8e5b4af1544f6205ec362b593092Patch
• https://github.com/NodeBB/NodeBB/security/advisories/GHSA-vh2g-6c4x-5hmpVendor Advisory
• https://security.netapp.com/advisory/ntap-20230831-0004/
• https://github.com/NodeBB/NodeBB/commit/ec58700f6dff8e5b4af1544f6205ec362b593092Patch
• https://github.com/NodeBB/NodeBB/security/advisories/GHSA-vh2g-6c4x-5hmpVendor Advisory
• https://security.netapp.com/advisory/ntap-20230831-0004/

Published

Jul 24, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-2604The Team Circle Image Slider With Lightbox plugin for WordPr…6.1
• CVE-2023-26040Discourse is an open-source discussion platform. Between ver…6.1
• CVE-2023-26041Nextcloud Talk is a fully on-premises audio/video and chat c…4.3
• CVE-2023-26042Part-DB is an open source inventory management system for yo…6.1
• CVE-2023-26043GeoNode is an open source platform that facilitates the crea…6.5
• CVE-2023-26044react/http is an event-driven, streaming HTTP client and ser…5.3
• CVE-2023-26046teler-waf is a Go HTTP middleware that provides teler IDS fu…6.1
• CVE-2023-26047teler-waf is a Go HTTP middleware that provides teler IDS fu…6.1
• CVE-2023-26048Jetty is a java based web server and servlet engine. In affe…5.3
• CVE-2023-26049Jetty is a java based web server and servlet engine. Nonstan…5.3
• CVE-2023-2605The wpbrutalai WordPress plugin before 2.0.1 does not saniti…6.1
• CVE-2023-26051Saleor is a headless, GraphQL commerce platform delivering p…4.3