{"id":"CVE-2023-36220","details":"Directory Traversal vulnerability in Textpattern CMS v4.8.8 allows a remote authenticated attacker to execute arbitrary code and gain access to sensitive information via the plugin Upload function.","modified":"2026-08-12T03:51:49.168802966Z","published":"2023-08-07T00:00:00Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36220.json"},"references":[{"type":"WEB","url":"https://packetstormsecurity.com/files/172967/Textpattern-CMS-4.8.8-Command-Injection.html"},{"type":"WEB","url":"https://release-demo.textpattern.co/"},{"type":"WEB","url":"https://textpattern.com/"},{"type":"WEB","url":"https://textpattern.com/file_download/118/textpattern-4.8.8.zip"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36220.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-36220"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/textpattern/textpattern","events":[{"introduced":"b90acf00e63e2be98f81e1cde58a5bea4b31dee9"},{"last_affected":"b90acf00e63e2be98f81e1cde58a5bea4b31dee9"}],"database_specific":{"extracted_events":[{"introduced":"4.8.8"},{"last_affected":"4.8.8"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:textpattern:textpattern:4.8.8:*:*:*:*:*:*:*"}}],"versions":["4.8.8"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-36220.json"}}],"schema_version":"1.9.0"}