CVE-2023-48710

iTop is an IT service management platform. Files from the `env-production` folder can be retrieved even though they should have restricted access. Hopefully, there is no sensitive files stored in that folder natively, but there could be from a third-party module. The `pages/exec.php` script as been fixed to limit execution of PHP files only. Other file types won't be retrieved and exposed. The vulnerability is fixed in 2.7.10, 3.0.4, 3.1.1, and 3.2.0.

Scoring

Severity

CRITICAL

CVSS base score

9.8

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS probability

0.43%

CWE

CWE-552

Published

2024-04-15

Last modified

2026-03-13

Affected products

• Combodo iTop
• Combodo iTop
• Combodo iTop

Weakness type

• CWE-552

Related vulnerabilities

• CVE-2023-50164 — Apache Struts: File upload component had a directory traversal vulnerability
• CVE-2024-6911 — Unauthenticated Local File Inclusion
• CVE-2024-6209 — unauthorized file access
• CVE-2025-34110 — ColoradoFTP Server <= 1.3 Build 8 Path Traversal Information Disclosure
• CVE-2025-68109 — ChurchCRM vulnerable to RCE with database restore functionality
• CVE-2023-2766 — Weaver OA jx2_config.ini file access
• CVE-2009-10005 — ContentKeeper Web Appliance < 125.10 Arbitrary File Access via mimencode
• CVE-2020-37082 — webERP 4.15.1 - Unauthenticated Backup File Access

Markdown version · Browse all CVEs