{"id":"CVE-2023-49793","summary":"Path traversal in `CodeChecker server` in the endpoint of `CodeChecker store`","details":"CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Zip files uploaded to the server endpoint of `CodeChecker store` are not properly sanitized. An attacker, using a path traversal attack, can load and display files on the machine of `CodeChecker server`. The vulnerable endpoint is `/Default/v6.53/CodeCheckerService@massStoreRun`. The path traversal vulnerability allows reading data on the machine of the `CodeChecker server`, with the same permission level as the `CodeChecker server`.\nThe attack requires a user account on the `CodeChecker server`, with permission to store to a server, and view the stored report. This vulnerability has been patched in version 6.23.","aliases":["GHSA-h26w-r4m5-8rrf","PYSEC-2024-54"],"modified":"2026-08-12T03:51:44.239389024Z","published":"2024-06-24T17:36:21.827Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49793.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-22"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49793.json"},{"type":"ADVISORY","url":"https://github.com/Ericsson/codechecker/security/advisories/GHSA-h26w-r4m5-8rrf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-49793"},{"type":"FIX","url":"https://github.com/Ericsson/codechecker/commit/46bada41e32f3ba0f6011d5c556b579f6dddf07a"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/ericsson/codechecker","events":[{"introduced":"0"},{"fixed":"bea15d4fb77478860dee41f6e7f206050720869a"},{"fixed":"46bada41e32f3ba0f6011d5c556b579f6dddf07a"}],"database_specific":{"cpe":"cpe:2.3:a:ericsson:codechecker:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"6.23.0"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v6.23.0-rc1","v6.22.0","v6.21.0","v6.20.0","v6.19.0","v6.18.0","v6.17.0","v6.16.0","v6.15.0","v6.14.0","v6.13.0","v6.12.0","v6.10.0","v6.9.1","v6.9.0","v6.8.1","v6.8.0","v6.7.1","v6.7.0","v6.6.0","v6.5.1","v6.5","v6.4","v6.3","v6.2","v6.2.1","v6.1.1","v6.1","v6.0.1","v6.0","v5.10","v5.9","v5.8","v5.7.1","v5.7","v5.6","v5.5","v5.4","v5.3","v5.2","v5.1","v5.0","v4.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-49793.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}]}