CVE-2023-36460

CRITICAL

Mastodon <3.5.9, <4.0.5, <4.1.3 - Remote Code Execution

Title source: llm
STIX 2.1

Description

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 3.5.0 and prior to versions 3.5.9, 4.0.5, and 4.1.3, attackers using carefully crafted media files can cause Mastodon's media processing code to create arbitrary files at any location. This allows attackers to create and overwrite any file Mastodon has access to, allowing Denial of Service and arbitrary Remote Code Execution. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue.

References (6)

Core 6

Scores

CVSS v3 9.9
EPSS 0.3856
EPSS Percentile 97.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-22
Status published
Products (1)
joinmastodon/mastodon 3.5.0 - 3.5.9
Published Jul 06, 2023
Tracked Since Feb 18, 2026