CVE-2023-24188 Arbitrary file deletion in ureport

Critical 9.1 Published 13 Feb 2023 Updated 9 Jul 2026

Attackers can delete arbitrary files via directory traversal in ureport's deletion function, impacting data integrity.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-24188?

CVE-2023-24188 is a critical path traversal vulnerability in n/a, published on 13 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

ureport v2.2.9 was discovered to contain a directory traversal vulnerability via the deletion function which allows for arbitrary files to be deleted.

Weakness: CWE-22

Which versions are affected by CVE-2023-24188?

2 open source packages ship an affected version, including com.bstek.ureport:ureport2-core. It affects 1 product.

Package	Affected	Fixed in
`com.bstek.ureport:ureport2-core` Maven	All versions to `2.2.9`	None
`com.bstek.ureport:ureport2-core` Maven	All versions to `2.2.9`	None

Products include Ureport Project Ureport.

How do I fix CVE-2023-24188?

No fix has been published for CVE-2023-24188 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2023-24188 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-24188 exists.

Sources

Also known as GHSA-6fcj-9vfw-jq2m.