CVE-2023-32317

Autolab is a course management service that enables auto-graded programming assignments. A Tar slip vulnerability was found in the MOSS cheat checker functionality of Autolab. To exploit this vulnerability an authenticated attacker with instructor permissions needs to upload a specially crafted Tar file. Both "Base File Tar" and "Additional file archive" can be fed with Tar files that contain paths outside their target directories (e.g., `../../../../tmp/tarslipped2.sh`). When the MOSS cheat checker is started the files inside of the archives are expanded to the attacker-chosen locations. This issue may lead to arbitrary file write within the scope of the running process. This issue has been addressed in version 2.11.0. Users are advised to upgrade.

• CWE-22
• CWE-22

• https://github.com/autolab/Autolab/commit/410a9228ee265f80692334d75eb2c3b4dac6f9e5Patch
• https://github.com/autolab/Autolab/security/advisories/GHSA-h8g5-vhm4-wx6gVendor Advisory
• https://securitylab.github.com/advisories/GHSL-2023-081_GHSL-2023-082_Autolab/
• https://github.com/autolab/Autolab/commit/410a9228ee265f80692334d75eb2c3b4dac6f9e5Patch
• https://github.com/autolab/Autolab/security/advisories/GHSA-h8g5-vhm4-wx6gVendor Advisory
• https://securitylab.github.com/advisories/GHSL-2023-081_GHSL-2023-082_Autolab/

Published

May 26, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-32311CloudExplorer Lite is an open source cloud management platfo…4.3
• CVE-2023-32312UmbracoIdentityExtensions is an Umbraco add-on package that …5.3
• CVE-2023-32313vm2 is a sandbox that can run untrusted code with Node's bui…5.3
• CVE-2023-32314vm2 is a sandbox that can run untrusted code with Node's bui…10
• CVE-2023-32315Openfire is an XMPP server licensed under the Open Source Ap…7.5
• CVE-2023-32316CloudExplorer Lite is an open source cloud management tool. …4.3
• CVE-2023-32318Nextcloud server provides a home for data. A regression in t…6.7
• CVE-2023-32319Nextcloud server is an open source personal cloud implementa…6.5
• CVE-2023-3232A vulnerability was found in Zhong Bang CRMEB up to 4.6.0 an…9.8
• CVE-2023-32320Nextcloud Server is a data storage system for Nextcloud, a s…7.5
• CVE-2023-32321CKAN is an open-source data management system for powering d…9.8
• CVE-2023-32322Ombi is an open source application which allows users to req…4.9