High severity7.2NVD Advisory· Published Jan 24, 2024· Updated Jun 17, 2026
CVE-2023-24676
CVE-2023-24676
Description
An issue found in ProcessWire 3.0.210 allows attackers to execute arbitrary code and install a reverse shell via the download_zip_url parameter when installing a new module. NOTE: this is disputed because exploitation requires that the attacker is able to enter requests as an admin; however, a ProcessWire admin is intentionally allowed to install any module that contains any arbitrary code.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
processwire/processwirePackagist | <= 3.0.210 | — |
Affected products
3- cpe:2.3:a:processwire:processwire:3.0.210:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
3- medium.com/%40cupc4k3/reverse-shell-via-remote-file-inlusion-in-proccesswire-cms-a8fa5ace3255nvdExploitThird Party AdvisoryWEB
- github.com/advisories/GHSA-2cvg-w29m-j8xcghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2023-24676ghsaADVISORY
News mentions
0No linked articles in our index yet.