CVE-2023-32322

Ombi is an open source application which allows users to request specific media from popular self-hosted streaming servers. Versions prior to 4.38.2 contain an arbitrary file read vulnerability where an Ombi administrative user may access files available to the Ombi server process on the host operating system. Ombi administrators may not always be local system administrators and so this may violate the security expectations of the system. The arbitrary file read vulnerability was present in `ReadLogFile` and `Download` endpoints in `SystemControllers.cs` as the parameter `logFileName` is not sanitized before being combined with the `Logs` directory. When using `Path.Combine(arg1, arg2, arg3)`, an attacker may be able to escape to folders/files outside of `Path.Combine(arg1, arg2)` by using ".." in `arg3`. In addition, by specifying an absolute path for `arg3`, `Path.Combine` will completely ignore the first two arguments and just return just `arg3`. This vulnerability can lead to information disclosure. The Ombi `documentation` suggests running Ombi as a Service with Administrator privileges. An attacker targeting such an application may be able to read the files of any Windows user on the host machine and certain system files. This issue has been addressed in commit `b8a8f029` and in release version 4.38.2. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as GHSL-2023-088.

• CWE-22
• CWE-22

• https://docs.ombi.app/guides/installation/#windowsProduct
• https://github.com/Ombi-app/Ombi/blob/v4.36.1/src/Ombi/Controllers/V2/SystemController.cs#L46Product
• https://github.com/Ombi-app/Ombi/blob/v4.36.1/src/Ombi/Controllers/V2/SystemController.cs#L58Product
• https://github.com/Ombi-app/Ombi/commit/b8a8f029d80454d582bc4a2a05175106809335d0Patch
• https://github.com/Ombi-app/Ombi/security/advisories/GHSA-28j3-84m7-gpjpExploit, Mitigation, Third Party Advisory
• https://docs.ombi.app/guides/installation/#windowsProduct
• https://github.com/Ombi-app/Ombi/blob/v4.36.1/src/Ombi/Controllers/V2/SystemController.cs#L46Product
• https://github.com/Ombi-app/Ombi/blob/v4.36.1/src/Ombi/Controllers/V2/SystemController.cs#L58Product
• https://github.com/Ombi-app/Ombi/commit/b8a8f029d80454d582bc4a2a05175106809335d0Patch
• https://github.com/Ombi-app/Ombi/security/advisories/GHSA-28j3-84m7-gpjpExploit, Mitigation, Third Party Advisory

Published

May 18, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-32317Autolab is a course management service that enables auto-gra…7.2
• CVE-2023-32318Nextcloud server provides a home for data. A regression in t…6.7
• CVE-2023-32319Nextcloud server is an open source personal cloud implementa…6.5
• CVE-2023-3232A vulnerability was found in Zhong Bang CRMEB up to 4.6.0 an…9.8
• CVE-2023-32320Nextcloud Server is a data storage system for Nextcloud, a s…7.5
• CVE-2023-32321CKAN is an open-source data management system for powering d…9.8
• CVE-2023-32323Synapse is an open-source Matrix homeserver written and main…4.3
• CVE-2023-32324OpenPrinting CUPS is an open source printing system. In vers…5.5
• CVE-2023-32325PostHog-js is a library to interface with the PostHog analyt…6.1
• CVE-2023-32327IBM Security Access Manager Container (IBM Security Verify A…7.1
• CVE-2023-32328IBM Security Verify Access 10.0.0.0 through 10.0.6.1 uses in…9.8
• CVE-2023-32329IBM Security Access Manager Container (IBM Security Verify A…5.5