CVE-2023-27701 Missing authorization in n/a
Attackers can arbitrarily delete files in MuYuCMS due to missing authorization checks in the database deletion component.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-27701?
CVE-2023-27701 is a high-severity missing authorization vulnerability in n/a, published on 28 Mar 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
MuYuCMS v2.2 was discovered to contain an arbitrary file deletion vulnerability via the component /database/sqldel.html.
Weakness: CWE-862
Which versions are affected by CVE-2023-27701?
It affects 1 product.
Products include Muyucms Muyucms.
How do I fix CVE-2023-27701?
No fix has been published for CVE-2023-27701 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-27701 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-27701 exists.
Other vulnerabilities in n/a
- CVE-2023-1046 MuYuCMS getFile.html server-side request forgery
- CVE-2025-15589 MuYuCMS Template Management Template.php delete_dir_file path traversal
- CVE-2025-10993 MuYuCMS Template Management admin.php code injection
- CVE-2023-1043 MuYuCMS index.php path traversal
- CVE-2023-1044 MuYuCMS index.php path traversal
Sources
Also known as GHSA-7mr7-f298-6rv8.