CVE-2023-32676

Autolab is a course management service that enables auto-graded programming assignments. A Tar slip vulnerability was found in the Install assessment functionality of Autolab. To exploit this vulnerability an authenticated attacker with instructor permissions needs to upload a specially crafted Tar file. Using the install assessment functionality an attacker can feed a Tar file that contain files with paths pointing outside of the target directory (e.g., `../../../../tmp/tarslipped1.sh`). When the Install assessment form is submitted the files inside of the archives are expanded to the attacker-chosen locations. This issue has been addressed in version 2.11.0. Users are advised to upgrade.

• CWE-22
• CWE-22

• https://github.com/autolab/Autolab/commit/14f508484a8323eceb0cf3a128573b43eabbc80dPatch
• https://github.com/autolab/Autolab/security/advisories/GHSA-x9hj-r9q4-832cVendor Advisory
• https://securitylab.github.com/advisories/GHSL-2023-081_GHSL-2023-082_Autolab/
• https://github.com/autolab/Autolab/commit/14f508484a8323eceb0cf3a128573b43eabbc80dPatch
• https://github.com/autolab/Autolab/security/advisories/GHSA-x9hj-r9q4-832cVendor Advisory
• https://securitylab.github.com/advisories/GHSL-2023-081_GHSL-2023-082_Autolab/

Published

May 26, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-32670Cross-Site Scripting vulnerability in BuddyBoss 2.2.9 vers…5.4
• CVE-2023-32671A stored XSS vulnerability has been found on BuddyBoss Platf…5.4
• CVE-2023-32672An Incorrect authorisation check in SQLLab in Apache Superse…4.3
• CVE-2023-32673Certain versions of HP PC Hardware Diagnostics Windows, HP I…9.8
• CVE-2023-32674Certain versions of HP PC Hardware Diagnostics Windows are p…9.8
• CVE-2023-32675Vyper is a pythonic Smart Contract Language for the ethereum…5.3
• CVE-2023-32677Zulip is an open-source team collaboration tool with unique …3.1
• CVE-2023-32678Zulip is an open-source team collaboration tool with topic-b…6.5
• CVE-2023-32679Craft CMS is an open source content management system. In af…7.2
• CVE-2023-3268An out of bounds (OOB) memory access flaw was found in the L…7.1
• CVE-2023-32680Metabase is an open source business analytics engine. To edi…9.6
• CVE-2023-32681Requests is a HTTP library. Since Requests 2.3.0, Requests h…6.1