UpHeron
All vulnerabilities

Servers and applications

CVE-2023-36460

Arbitrary file creation through media attachments

Severity
Critical 9.9
Published
6 Jul 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
3.5.9, 4.0.5, 4.1.3
Also known as
GHSA-9928-3cp5-93fm
Sources
NVD, Project advisories (GitHub)

Description

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 3.5.0 and prior to versions 3.5.9, 4.0.5, and 4.1.3, attackers using carefully crafted media files can cause Mastodon's media processing code to create arbitrary files at any location. This allows attackers to create and overwrite any file Mastodon has access to, allowing Denial of Service and…

Affected software

SoftwareAffected versions
MastodonServers and applications · cpe:a:joinmastodon:mastodon
  • From 3.5.0 before 3.5.9
  • From 4.0.0 before 4.0.5
  • From 4.1.0 before 4.1.3
MastodonServers and applications · github:mastodon/mastodon
  • From 3.5.0 before 3.5.9

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-36460
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-36460
  • GitHub Advisory Database https://github.com/advisories/GHSA-9928-3cp5-93fm
  • github.com https://github.com/mastodon/mastodon/security/advisories/GHSA-9928-3cp5-93fm