{"id":"CVE-2023-33690","details":"SonicJS up to v0.7.0 allows attackers to execute an authenticated path traversal when an attacker injects special characters into the filename of a backup CMS.","modified":"2026-08-27T04:02:39.751672016Z","published":"2023-06-05T00:00:00Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33690.json"},"references":[{"type":"WEB","url":"https://youtu.be/6ZuwA9CkQLg"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33690.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33690"},{"type":"FIX","url":"https://github.com/lane711/sonicjs/pull/183"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/SonicJs-Org/sonicjs","events":[{"introduced":"5ec9b390e5eb8feb3588c69dfc3beda0fa8d162e"},{"last_affected":"f85b9a644ea7c3583cedd2f5f23be818facf799b"}],"database_specific":{"source":"CPE_RANGE","cpe":"cpe:2.3:a:sonicjs:sonicjs:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0.5.4"},{"last_affected":"0.7.0"}]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-33690.json"}}],"schema_version":"1.9.0"}