Vulnerability · Published Aug 4, 2023 · Assigned by mitre
CVE-2023-29689
Critical 9.8
In plain English
A critical-severity security flaw in the pyrocms/pyrocms package (Packagist). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 53.5% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)53.5%top 1.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC
Official description
PyroCMS 3.9 contains a remote code execution (RCE) vulnerability that can be exploited through a server-side template injection (SSTI) flaw. This vulnerability allows a malicious attacker to send customized commands to the server and execute arbitrary code on the affected system.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | pyrocms/pyrocms | no fix listed | GHSA-w7vm-4v3j-vgpw |