CVE-2023-33177 Xibo CMS vulnerable to Remote Code Execution through Zip Slip

High 8.8 Published 30 May 2023 Updated 17 Jun 2025

Authenticated attackers can upload malicious zip files to achieve remote code execution via path traversal in Xibo CMS.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-33177?

CVE-2023-33177 is a high-severity path traversal vulnerability in xibosignage xibo-cms, published on 30 May 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Xibo is a content management system (CMS). A path traversal vulnerability exists in the Xibo CMS whereby a specially crafted zip file can be uploaded to the CMS via the layout import function by an authenticated user which would allow creation of files outside of the CMS library directory as the webserver user. This can be used to upload a PHP webshell inside the web root directory and achieve remote code execution as the webserver user. Users should upgrade to version 2.3.17 or 3.3.5, which fix this issue. Customers who host their CMS with Xibo Signage have already received an upgrade or patch to resolve this issue regardless of the CMS version that they are running.

Weakness: CWE-22

Which versions are affected by CVE-2023-33177?

It affects 1 product.

Products include Xibosignage Xibo.

How do I fix CVE-2023-33177?

No fix has been published for CVE-2023-33177 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2023-33177 being exploited?

There is no known exploitation of CVE-2023-33177 in the wild and no public exploit code.

Public exploit code: 1 Exploit-DB entry and 2 proofs of concept on GitHub.

Sources

Also known as GHSA-jj27-x85q-crqv.