CVE-2023-33177

HIGH

Xibo CMS <2.3.17-3.3.5 - Path Traversal

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 3 public exploits for CVE-2023-33177. PoCs published by complexusprada, kaxm23.

AI-analyzed exploit summary This script generates a malicious ZIP file exploiting a path traversal vulnerability (Zip Slip) in Xibo CMS's layout import functionality, allowing authenticated attackers to achieve remote code execution via a PHP webshell.

Description

Xibo is a content management system (CMS). A path traversal vulnerability exists in the Xibo CMS whereby a specially crafted zip file can be uploaded to the CMS via the layout import function by an authenticated user which would allow creation of files outside of the CMS library directory as the webserver user. This can be used to upload a PHP webshell inside the web root directory and achieve remote code execution as the webserver user. Users should upgrade to version 2.3.17 or 3.3.5, which fix this issue. Customers who host their CMS with Xibo Signage have already received an upgrade or patch to resolve this issue regardless of the CMS version that they are running.

Exploits (3)

exploitdb WORKING POC
by complexusprada · pythonwebappsmultiple
https://www.exploit-db.com/exploits/52500

This script generates a malicious ZIP file exploiting a path traversal vulnerability (Zip Slip) in Xibo CMS's layout import functionality, allowing authenticated attackers to achieve remote code execution via a PHP webshell.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Xibo CMS 1.8.0-2.3.16, 3.0.0-3.3.4
Auth required
Prerequisites: Valid Xibo CMS credentials with layout import permission
devstral-2 · analyzed Apr 10, 2026 Full analysis →
nomisec WORKING POC
by kaxm23 · poc
https://github.com/kaxm23/-CVE-2023-33177-

This repository contains a functional Python-based exploit for CVE-2023-33177, a Zip Slip path traversal vulnerability in Xibo CMS that leads to Remote Code Execution (RCE). The exploit automates authentication, payload generation, and vulnerability verification by attempting to write a test file to the server.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Xibo CMS versions 1.8.0-2.3.16 and 3.0.0-3.3.4
Auth required
Prerequisites: Valid Xibo CMS credentials · Network access to the target instance · Python 3.6+ with requests library
devstral-2 · analyzed Apr 10, 2026 Full analysis →
nomisec WORKING POC
by complexusprada · poc
https://github.com/complexusprada/Xibo-CMS-Zip-Slip-RCE-Exploit-CVE-2023-33177

This exploit demonstrates a path traversal vulnerability (Zip Slip) in Xibo CMS, allowing remote code execution via malicious layout imports. It generates a ZIP file with a traversal payload in `mapping.json` to write a PHP webshell to the web root.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Xibo CMS 1.8.0 - 2.3.16, 3.0.0 - 3.3.4
Auth required
Prerequisites: Authenticated access to Xibo CMS · Ability to upload layout ZIP files
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Scores

CVSS v3 8.8
EPSS 0.0709
EPSS Percentile 93.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-22
Status published
Products (1)
xibosignage/xibo 1.8.0 - 2.3.17
Published May 30, 2023
Tracked Since Feb 18, 2026