CVE-2023-36319

HIGH

Openupload 0.4.3 - Remote Code Execution via Compress Action Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2023-36319. PoCs published by Lowalu.

AI-analyzed exploit summary This PoC demonstrates a command injection vulnerability in OpenUpload's compression plugin, allowing arbitrary command execution during file upload. The exploit involves modifying plugin settings and triggering execution via a crafted upload request.

Description

File Upload vulnerability in Openupload Stable v.0.4.3 allows a remote attacker to execute arbitrary code via the action parameter of the compress-inc.php file.

Exploits (1)

nomisec WORKING POC
by Lowalu · poc
https://github.com/Lowalu/CVE-2023-36319

This PoC demonstrates a command injection vulnerability in OpenUpload's compression plugin, allowing arbitrary command execution during file upload. The exploit involves modifying plugin settings and triggering execution via a crafted upload request.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: OpenUpload Stable version 0.4.3
Auth required
Prerequisites: Authenticated access to OpenUpload admin panel · Compression plugin enabled
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2
Core References
Exploit, Third Party Advisory
https://github.com/Lowalu/CVE-2023-36319

Scores

CVSS v3 8.8
EPSS 0.0165
EPSS Percentile 73.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-434
Status published
Products (1)
openupload_project/openupload 0.4.3
Published Sep 20, 2023
Tracked Since Feb 18, 2026