CVE-2023-46253

Squidex is an open source headless CMS and content management hub. Affected versions are subject to an arbitrary file write vulnerability in the backup restore feature which allows an authenticated attacker to gain remote code execution (RCE). Squidex allows users with the `squidex.admin.restore` permission to create and restore backups. Part of these backups are the assets uploaded to an App. For each asset, the backup zip archive contains a `.asset` file with the actual content of the asset as well as a related `AssetCreatedEventV2` event, which is stored in a JSON file. Amongst other things, the JSON file contains the event type (`AssetCreatedEventV2`), the ID of the asset (`46c05041-9588-4179-b5eb-ddfcd9463e1e`), its filename (`test.txt`), and its file version (`0`). When a backup with this event is restored, the `BackupAssets.ReadAssetAsync` method is responsible for re-creating the asset. For this purpose, it determines the name of the `.asset` file in the zip archive, reads its content, and stores the content in the filestore. When the asset is stored in the filestore via the UploadAsync method, the assetId and fileVersion are passed as arguments. These are further passed to the method GetFileName, which determines the filename where the asset should be stored. The assetId is inserted into the filename without any sanitization and an attacker with squidex.admin.restore privileges to run arbitrary operating system commands on the underlying server (RCE).

• CWE-22

• https://github.com/Squidex/squidex/security/advisories/GHSA-phqq-8g7v-3pg5Exploit, Vendor Advisory
• https://github.com/Squidex/squidex/security/advisories/GHSA-phqq-8g7v-3pg5Exploit, Vendor Advisory

Published

Nov 7, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-46248Cody is an artificial intelligence (AI) coding assistant. Th…8.8
• CVE-2023-46249authentik is an open-source Identity Provider. Prior to vers…9.8
• CVE-2023-4625Improper Restriction of Excessive Authentication Attempts vu…5.3
• CVE-2023-46250pypdf is a free and open-source pure-python PDF library. An …5.5
• CVE-2023-46251 MyBB is a free and open source forum software. Custom MyCod…6.1
• CVE-2023-46252Squidex is an open source headless CMS and content managemen…6.1
• CVE-2023-46254capsule-proxy is a reverse proxy for Capsule kubernetes mult…4.3
• CVE-2023-46255SpiceDB is an open source, Google Zanzibar-inspired database…6.5
• CVE-2023-46256PX4-Autopilot provides PX4 flight control solution for drone…9.8
• CVE-2023-46257An attacker sending specially crafted data packets to the Mo…9.8
• CVE-2023-46258An attacker sending specially crafted data packets to the Mo…9.8
• CVE-2023-46259An attacker sending specially crafted data packets to the Mo…9.8