{"id":"CVE-2023-2868","details":"A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives). The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl's qx operator with the privileges of the Email Security Gateway product. This issue was fixed as part of BNSF-36456 patch. This patch was automatically applied to all customer appliances.","modified":"2026-05-04T08:42:47.583649Z","published":"2023-05-24T19:15:09.363Z","withdrawn":"2026-05-04T08:42:47.583649Z","references":[{"type":"WEB","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-2868"},{"type":"ADVISORY","url":"https://status.barracuda.com/incidents/34kx82j5n4q9"},{"type":"ADVISORY","url":"https://www.barracuda.com/company/legal/esg-vulnerability"}],"affected":[{"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-2868.json","unresolved_ranges":[{"events":[{"introduced":"5.1.3.001"},{"last_affected":"9.2.0.006"}]},{"events":[{"introduced":"5.1.3.001"},{"last_affected":"9.2.0.006"}]},{"events":[{"introduced":"5.1.3.001"},{"last_affected":"9.2.0.006"}]},{"events":[{"introduced":"5.1.3.001"},{"last_affected":"9.2.0.006"}]},{"events":[{"introduced":"5.1.3.001"},{"last_affected":"9.2.0.006"}]}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}