Vulnerability · Published Oct 15, 2025 · Assigned by VulnCheck

CVE-2023-7305SmartBI RMIServlet Unrestricted File Upload RCE

Critical 9.2

In plain English

A critical-severity unrestricted file upload in SmartBI from Guangzhou Smart Software Co., Ltd.. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 4.0)9.2Critical

Exploit odds (30 days)0.5%top 54.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

SmartBI V8, V9, and V10 contain an unrestricted file upload vulnerability via the RMIServlet request handling logic. Under certain configurations or usage patterns, attackers can send specially crafted requests that cause the application to perform sensitive operations or execute arbitrary code on the host. The vendor released a fix in July 2023 to address the underlying flaw. VulnCheck has observed this vulnerability being exploited in the wild.

Affected products (as reported)

Vendor	Product	Versions
Guangzhou Smart Software Co., Ltd.	SmartBI	V8 – before July 2023 updateV9 – before July 2023 updateV10 – before July 2023 update

Weakness: CWE-434 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://www.smartbi.com.cn/patchinfo release-notes, patch
https://avd.aliyun.com/detail?id=AVD-2023-1673292 vdb-entry
https://jeyiuwai.pages.dev/posts/1day-%E8%B7%9F%E8%B8%AAsmartbi-rmiservlet-%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E/ technical-description, exploit
https://www.vulncheck.com/advisories/smartbi-rmiservlet-unrestricted-file-upload-rce third-party-advisory