CVE-2023-36460

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 3.5.0 and prior to versions 3.5.9, 4.0.5, and 4.1.3, attackers using carefully crafted media files can cause Mastodon's media processing code to create arbitrary files at any location. This allows attackers to create and overwrite any file Mastodon has access to, allowing Denial of Service and arbitrary Remote Code Execution. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue.

• CWE-22

• http://www.openwall.com/lists/oss-security/2023/07/06/4Mailing List
• https://github.com/mastodon/mastodon/commit/dc8f1fbd976ae544720a4e07120d9a91b2722440Patch, Third Party Advisory
• https://github.com/mastodon/mastodon/releases/tag/v3.5.9Third Party Advisory
• https://github.com/mastodon/mastodon/releases/tag/v4.0.5Third Party Advisory
• https://github.com/mastodon/mastodon/releases/tag/v4.1.3Third Party Advisory
• https://github.com/mastodon/mastodon/security/advisories/GHSA-9928-3cp5-93fmThird Party Advisory
• http://www.openwall.com/lists/oss-security/2023/07/06/4Mailing List
• https://github.com/mastodon/mastodon/commit/dc8f1fbd976ae544720a4e07120d9a91b2722440Patch, Third Party Advisory
• https://github.com/mastodon/mastodon/releases/tag/v3.5.9Third Party Advisory
• https://github.com/mastodon/mastodon/releases/tag/v4.0.5Third Party Advisory
• https://github.com/mastodon/mastodon/releases/tag/v4.1.3Third Party Advisory
• https://github.com/mastodon/mastodon/security/advisories/GHSA-9928-3cp5-93fmThird Party Advisory

Published

Jul 6, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-3645The Contact Form Builder by Bit Form WordPress plugin before…4.8
• CVE-2023-36456authentik is an open-source Identity Provider. Prior to vers…7.3
• CVE-2023-364571Panel is an open source Linux server operation and maintena…8.8
• CVE-2023-364581Panel is an open source Linux server operation and maintena…8.8
• CVE-2023-36459Mastodon is a free, open-source social network server based …6.1
• CVE-2023-3646On affected platforms running Arista EOS with mirroring to m…7.5
• CVE-2023-36461Mastodon is a free, open-source social network server based …7.5
• CVE-2023-36462Mastodon is a free, open-source social network server based …5.4
• CVE-2023-36463Meldekarten generator is an open source project to create a …6.1
• CVE-2023-36464pypdf is an open source, pure-python PDF library. In affecte…5.5
• CVE-2023-36465Decidim is a participatory democracy framework, written in R…7.1
• CVE-2023-36466Discourse is an open source discussion platform. When editin…4.3