CVE-2023-30859: Triton is a Minecraft plugin for Spigot and BungeeCord that helps you translate your Minecraft server. The CustomPayload packet allows you to execute ...

Description

Triton is a Minecraft plugin for Spigot and BungeeCord that helps you translate your Minecraft server. The CustomPayload packet allows you to execute commands on the spigot/bukkit console. When you enable bungee mode in the config it will enable the bungee bridge and the server will begin to broadcast the 'triton:main' plugin channel. Using this plugin channel you are able to send a payload packet containing a byte (2) and a string (any spigot command). This could be used to make yourself a server operator and be used to extract other user information through phishing (pretending to be an admin), many servers use essentials so the /geoip command could be available to them, etc. This could also be modified to allow you to set the servers language, set another players language, etc. This issue affects those who have bungee enabled in config. This issue has been fixed in version 3.8.4.

Metrics

CVSS 3.1

9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

1.07%

60.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-419

Affected Software

Vendor	Product	Versions
Triton Project	Triton	< 3.7.5
Triton Project	Triton	>= 3.8.0, < 3.8.4

References

https://github.com/tritonmc/Triton/releases/tag/v3.8.4Release Notes
https://github.com/tritonmc/Triton/security/advisories/GHSA-8vj5-jccf-q25rExploit, Vendor Advisory
https://github.com/tritonmc/Triton/releases/tag/v3.8.4Release Notes
https://github.com/tritonmc/Triton/security/advisories/GHSA-8vj5-jccf-q25rExploit, Vendor Advisory

Timeline

Published: May 1, 2023
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2023-30859?

Triton is a Minecraft plugin for Spigot and BungeeCord that helps you translate your Minecraft server. The CustomPayload packet allows you to execute commands on the spigot/bukkit console. When you enable bungee mode in the config it will enable the bungee bridge and the server will begin to broadcast the 'triton:main' plugin channel. Using this plugin channel you are able to send a payload packet containing a byte (2) and a string (any spigot command). This could be used to make yourself a server operator and be used to extract other user information through phishing (pretending to be an admin), many servers use essentials so the /geoip command could be available to them, etc. This could also be modified to allow you to set the servers language, set another players language, etc. This issue affects those who have bungee enabled in config. This issue has been fixed in version 3.8.4.

How severe is CVE-2023-30859?

CVE-2023-30859 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 1.07% probability of exploitation in the next 30 days.

How do I fix CVE-2023-30859?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.