CVE-2023-3491

Name of the Vulnerable Software and Affected Versions fossbilling/fossbilling versions prior to 0.5.3

Description The issue involves an unrestricted upload of a file with a dangerous type. This can potentially lead to remote code execution (RCE) in FossBilling. The problem is related to the addition of a php-file in a request to update a theme.

Recommendations For versions prior to 0.5.3, update to version 0.5.3 or later to resolve the issue. As a temporary workaround, consider restricting the upload of files to prevent potential exploitation until a patch is applied.