CVE-2023-49793

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Zip files uploaded to the server endpoint of `CodeChecker store` are not properly sanitized. An attacker, using a path traversal attack, can load and display files on the machine of `CodeChecker server`. The vulnerable endpoint is `/Default/v6.53/CodeCheckerService@massStoreRun`. The path traversal vulnerability allows reading data on the machine of the `CodeChecker server`, with the same permission level as the `CodeChecker server`. The attack requires a user account on the `CodeChecker server`, with permission to store to a server, and view the stored report. This vulnerability has been patched in version 6.23.

• CWE-22
• CWE-22

• https://github.com/Ericsson/codechecker/commit/46bada41e32f3ba0f6011d5c556b579f6dddf07aPatch
• https://github.com/Ericsson/codechecker/security/advisories/GHSA-h26w-r4m5-8rrfExploit, Vendor Advisory
• https://github.com/Ericsson/codechecker/commit/46bada41e32f3ba0f6011d5c556b579f6dddf07aPatch
• https://github.com/Ericsson/codechecker/security/advisories/GHSA-h26w-r4m5-8rrfExploit, Vendor Advisory

Published

Jun 24, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-49787Rejected reason: CVE request originates from private reposit…
• CVE-2023-49788Collabora Online is a collaborative online office suite base…7.2
• CVE-2023-4979Cross-site Scripting (XSS) - Reflected in GitHub repository …5.4
• CVE-2023-49790The Nextcloud iOS Files app allows users of iOS to interact …4.3
• CVE-2023-49791Nextcloud Server provides data storage for Nextcloud, an ope…5.4
• CVE-2023-49792Nextcloud Server provides data storage for Nextcloud, an ope…9.8
• CVE-2023-49794KernelSU is a Kernel-based root solution for Android devices…7.8
• CVE-2023-49795MindsDB connects artificial intelligence models to real time…5.3
• CVE-2023-49796MindsDB connects artificial intelligence models to real time…5.3
• CVE-2023-49797PyInstaller bundles a Python application and all its depende…7.8
• CVE-2023-49798OpenZeppelin Contracts is a library for smart contract devel…7.5
• CVE-2023-49799`nuxt-api-party` is an open source module to proxy API reque…7.5