CVE-2023-40051 Progress Application Server (PAS) for OpenEdge File Upload via Directory Traversal

Critical 9.1 Published 18 Jan 2024 Updated 2 Jun 2025

Attackers can upload malicious files to the Progress Application Server via directory traversal, potentially leading to code execution or further network compromise.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-40051?

CVE-2023-40051 is a critical vulnerability in Progress Software Corporation OpenEdge, published on 18 Jan 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation releases prior to 12.8.0. An attacker can formulate a request for a WEB transport that allows unintended file uploads to a server directory path on the system running PASOE. If the upload contains a payload that can further exploit the server or its network, the launch of a larger scale attack may be possible.

Weakness: CWE-434

Which versions are affected by CVE-2023-40051?

It affects 2 products.

Products include Progress Openedge, Progress Openedge Innovation.

How do I fix CVE-2023-40051?

No fix has been published for CVE-2023-40051 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-40051 being exploited?

There is no known exploitation of CVE-2023-40051 in the wild and no public exploit code.

Sources

Also known as GHSA-8crr-j42r-277p.