CVE-2023-40035

Craft is a CMS for creating custom digital experiences on the web and beyond. Bypassing the validatePath function can lead to potential remote code execution. This vulnerability can lead to malicious control of vulnerable systems and data exfiltrations. Although the vulnerability is exploitable only in the authenticated users, configuration with ALLOW_ADMIN_CHANGES=true, there is still a potential security threat (Remote Code Execution). This issue has been patched in version 4.4.15 and version 3.8.15.

• CWE-74

• https://github.com/craftcms/cms/commit/0bd33861abdc60c93209cff03eeee54504d3d3b5Patch
• https://github.com/craftcms/cms/releases/tag/3.8.15Release Notes
• https://github.com/craftcms/cms/releases/tag/4.4.15Release Notes
• https://github.com/craftcms/cms/security/advisories/GHSA-44wr-rmwq-3phwExploit, Vendor Advisory
• https://github.com/craftcms/cms/commit/0bd33861abdc60c93209cff03eeee54504d3d3b5Patch
• https://github.com/craftcms/cms/releases/tag/3.8.15Release Notes
• https://github.com/craftcms/cms/releases/tag/4.4.15Release Notes
• https://github.com/craftcms/cms/security/advisories/GHSA-44wr-rmwq-3phwExploit, Vendor Advisory

Published

Aug 23, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-4003 One Identity Password Manager version 5.9.7.1 - An unauthen…6.8
• CVE-2023-40030Cargo downloads a Rust project’s dependencies and compiles t…6.1
• CVE-2023-40031Notepad++ is a free and open-source source code editor. Vers…7.8
• CVE-2023-40032libvips is a demand-driven, horizontally threaded image proc…5.5
• CVE-2023-40033Flarum is an open source forum software. Flarum is affected …7.1
• CVE-2023-40034Woodpecker is a community fork of the Drone CI system. In af…8.1
• CVE-2023-40036Notepad++ is a free and open-source source code editor. Vers…5.5
• CVE-2023-40037Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS …6.5
• CVE-2023-40038Arris DG860A and DG1670A devices have predictable default WP…8.8
• CVE-2023-40039An issue was discovered on ARRIS TG852G, TG862G, and TG1672G…9.8
• CVE-2023-4004A use-after-free flaw was found in the Linux kernel's netfil…7.8
• CVE-2023-40040An issue was discovered in the MyCrops HiGrade "THC Testing …5.3