CVE-2023-0947

Deeper analysis

CVE-2023-0947 is a path traversal vulnerability, tracked as CWE-22, that affects the FlatPress blogging platform in the flatpressblog/flatpress GitHub repository for all versions prior to 1.3. The flaw received a CVSS 3.1 score of 9.8, reflecting network-accessible attack vectors that require no authentication or user interaction and can impact confidentiality, integrity, and availability.

An unauthenticated attacker can supply crafted path sequences to read or write arbitrary files on the underlying server, enabling full system compromise in affected deployments. Because the vulnerability is reachable over the network without credentials, remote exploitation can lead to source-code disclosure, configuration tampering, or execution of attacker-controlled content.

Public references point to a specific commit that resolves the issue in version 1.3, and the flaw was originally reported through the huntr.dev coordinated disclosure platform. Administrators are advised to upgrade immediately to the patched release to eliminate the traversal vectors.

EPSS scores for the CVE rose from lower values to a peak of 0.8056 before receding to the current 0.5298, indicating a period of heightened exploitation interest after disclosure.