CVE-2023-48710

iTop is an IT service management platform. Files from the `env-production` folder can be retrieved even though they should have restricted access. Hopefully, there is no sensitive files stored in that folder natively, but there could be from a third-party module. The `pages/exec.php` script as been fixed to limit execution of PHP files only. Other file types won't be retrieved and exposed. The vulnerability is fixed in 2.7.10, 3.0.4, 3.1.1, and 3.2.0.

• CWE-552
• CWE-552

• https://github.com/Combodo/iTop/commit/3b2da39469f7a4636ed250ed0d33f4efff38be26Patch
• https://github.com/Combodo/iTop/security/advisories/GHSA-g652-q7cc-7hfcVendor Advisory
• https://github.com/Combodo/iTop/commit/3b2da39469f7a4636ed250ed0d33f4efff38be26Patch
• https://github.com/Combodo/iTop/security/advisories/GHSA-g652-q7cc-7hfcVendor Advisory

Published

Apr 15, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-48705Nautobot is a Network Source of Truth and Network Automation…5.4
• CVE-2023-48706Vim is a UNIX editor that, prior to version 9.0.2121, has a …4.7
• CVE-2023-48707CodeIgniter Shield is an authentication and authorization pr…6.5
• CVE-2023-48708CodeIgniter Shield is an authentication and authorization pr…6.5
• CVE-2023-48709iTop is an IT service management platform. When exporting d…8
• CVE-2023-4871A vulnerability classified as critical was found in SourceCo…9.8
• CVE-2023-48711google-translate-api-browser is an npm package which interfa…3.7
• CVE-2023-48712Warpgate is an open source SSH, HTTPS and MySQL bastion host…8.8
• CVE-2023-48713Knative Serving builds on Kubernetes to support deploying an…5.3
• CVE-2023-48714Silverstripe Framework is the framework that forms the base …4.3
• CVE-2023-48715Tuleap is an open source suite to improve management of soft…5.4
• CVE-2023-48716Student Result Management System v1.0 is vulnerable to multi…9.8