CVE-2023-50264

Bazarr manages and downloads subtitles. Prior to 1.3.1, Bazarr contains an arbitrary file read in /system/backup/download/ endpoint in bazarr/app/ui.py does not validate the user-controlled filename variable and uses it in the send_file function, which leads to an arbitrary file read on the system. This issue is fixed in version 1.3.1.

• CWE-22

• https://github.com/morpheus65535/bazarr/commit/17add7fbb3ae1919a40d505470d499d46df9ae6bPatch
• https://github.com/morpheus65535/bazarr/releases/tag/v1.3.1Release Notes
• https://securitylab.github.com/advisories/GHSL-2023-192_GHSL-2023-194_bazarr/Exploit, Third Party Advisory
• https://github.com/morpheus65535/bazarr/commit/17add7fbb3ae1919a40d505470d499d46df9ae6bPatch
• https://github.com/morpheus65535/bazarr/releases/tag/v1.3.1Release Notes
• https://securitylab.github.com/advisories/GHSL-2023-192_GHSL-2023-194_bazarr/Exploit, Third Party Advisory

Published

Dec 15, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-50258Medusa is an automatic video library manager for TV shows. V…5.3
• CVE-2023-50259Medusa is an automatic video library manager for TV shows. V…5.3
• CVE-2023-5026A vulnerability classified as problematic has been found in …6.1
• CVE-2023-50260Wazuh is a free and open source platform used for threat pre…8.8
• CVE-2023-50262Dompdf is an HTML to PDF converter for PHP. When parsing SVG…7.5
• CVE-2023-50263Nautobot is a Network Source of Truth and Network Automation…5.3
• CVE-2023-50265Bazarr manages and downloads subtitles. Prior to 1.3.1, the …7.5
• CVE-2023-50266Bazarr manages and downloads subtitles. In version 1.2.4, th…5.3
• CVE-2023-50267MeterSphere is a one-stop open source continuous testing pla…4.3
• CVE-2023-50268jq is a command-line JSON processor. Version 1.7 is vulnerab…5.5
• CVE-2023-50269Squid is a caching proxy for the Web. Due to an Uncontrolled…7.5
• CVE-2023-5027A vulnerability classified as critical was found in SourceCo…7.5