Low severity3.1NVD Advisory· Published Oct 30, 2023· Updated Jun 17, 2026
CVE-2023-42804
CVE-2023-42804
Description
BigBlueButton is an open-source virtual classroom. BigBlueButton prior to version 2.6.0-beta.1 has a path traversal vulnerability that allows an attacker with a valid starting folder path, to traverse and read other files without authentication, assuming the files have certain extensions (txt, swf, svg, png). In version 2.6.0-beta.1, input validation was added on the parameters being passed and dangerous characters are stripped. There are no known workarounds.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
8cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:*+ 6 more
- cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:*range: <=2.5.18
- cpe:2.3:a:bigbluebutton:bigbluebutton:2.6.0:alpha1:*:*:*:*:*:*
- cpe:2.3:a:bigbluebutton:bigbluebutton:2.6.0:alpha2:*:*:*:*:*:*
- cpe:2.3:a:bigbluebutton:bigbluebutton:2.6.0:alpha3:*:*:*:*:*:*
- cpe:2.3:a:bigbluebutton:bigbluebutton:2.6.0:alpha4:*:*:*:*:*:*
- (no CPE)range: <2.6.0-beta.1
- (no CPE)range: < 2.6.0-beta.1
- Range: <2.6.0-beta.1
Patches
Vulnerability mechanics
References
2- github.com/bigbluebutton/bigbluebutton/pull/15960nvdThird Party Advisory
- github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-3qjg-229m-vq84nvdThird Party Advisory
News mentions
0No linked articles in our index yet.