{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/openupload-0.4.3/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:openupload_project:openupload:0.4.3:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2023-36319"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Openupload (0.4.3)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Openupload"],"content_html":"\u003cp\u003eCVE-2023-36319 is a command injection vulnerability in Openupload version 0.4.3. An authenticated user with low privileges can modify the \u0026quot;command\u0026quot; directive within the administrative compression plugin settings. Subsequent file uploads trigger the execution of the injected command on the server.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates to the Openupload backend with low-privilege credentials.\u003c/li\u003e\n\u003cli\u003eAttacker navigates to the Administration -\u0026gt; Plugins -\u0026gt; compress interface.\u003c/li\u003e\n\u003cli\u003eAttacker submits a POST request to 'index.php' with 'action=adminpluginsoptions', 'step=4', 'id=compress', and a malicious payload in the 'command' parameter.\u003c/li\u003e\n\u003cli\u003eThe application saves the malicious command directive into the plugin configuration.\u003c/li\u003e\n\u003cli\u003eAttacker navigates to the File upload function.\u003c/li\u003e\n\u003cli\u003eAttacker initiates a file upload with the 'compress' parameter set to '0'.\u003c/li\u003e\n\u003cli\u003eThe application executes the previously stored malicious command during the upload process.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in arbitrary command execution with the privileges of the web server user, leading to potential full system compromise, data theft, and manipulation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify and audit all instances of Openupload 0.4.3 within the environment.\u003c/li\u003e\n\u003cli\u003eApply security patches if available from the vendor; if the software is unmaintained, restrict administrative access to the backend to highly trusted internal subnets.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rules below to monitor for suspicious administrative plugin configuration changes and subsequent process execution from the web server.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-28T23:37:11Z","date_published":"2026-10-28T23:37:11Z","id":"https://feed.craftedsignal.io/briefs/2026-10-openupload-cve-2023-36319/","summary":"Openupload 0.4.3 contains a command injection vulnerability allowing authenticated users to execute arbitrary commands by modifying the compression plugin configuration.","title":"Openupload: Command Injection via Compression Plugin (CVE-2023-36319)","url":"https://feed.craftedsignal.io/briefs/2026-10-openupload-cve-2023-36319/"}],"language":"en","title":"CraftedSignal Threat Feed - Openupload (0.4.3)","version":"https://jsonfeed.org/version/1.1"}