Critical severityNVD Advisory· Published Oct 15, 2025· Updated Apr 15, 2026

CVE-2023-7305

Description

SmartBI V8, V9, and V10 contain an unrestricted file upload vulnerability via the RMIServlet request handling logic. Under certain configurations or usage patterns, attackers can send specially crafted requests that cause the application to perform sensitive operations or execute arbitrary code on the host. The vendor released a fix in July 2023 to address the underlying flaw. VulnCheck has observed this vulnerability being exploited in the wild.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

SmartBI/SmartBIllm-create
Range: V8, V9, V10

Patches

Vulnerability mechanics

References

avd.aliyun.com/detailnvd
jeyiuwai.pages.dev/posts/1day-%E8%B7%9F%E8%B8%AAsmartbi-rmiservlet-%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E/nvd
www.smartbi.com.cn/patchinfonvd
www.vulncheck.com/advisories/smartbi-rmiservlet-unrestricted-file-upload-rcenvd

News mentions

No linked articles in our index yet.

cvss	0.585
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000