6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

CVE ID

CVE-2023-28459

GHSA ID

GHSA-wh3w-jcc7-mhmf

EPSS Score

0.49385%

CWE

CWE-22

Published

4/20/2023

Updated

10/21/2024

KEV Status

Technology

Python

Basic Information

CVE ID

GHSA ID

EPSS Score

CWE

Published

Updated

KEV Status

Technology

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2023-28459

CVE-2023-28459: pretalx vulnerable to path traversal in HTML export

pretalx before 2.3.2 allows path traversal in HTML export (a non-default feature). Users were able to upload crafted HTML documents that trigger the reading of arbitrary files.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2023-28459

CVE-2023-28459:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

CVE ID

CVE-2023-28459

GHSA ID

GHSA-wh3w-jcc7-mhmf

EPSS Score

0.49385%

CWE

CWE-22

Published

4/20/2023

Updated

10/21/2024

KEV Status

Technology

Python

Basic Information

CVE ID

GHSA ID

EPSS Score

CWE

Published

Updated

KEV Status

Technology

Technical Details

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pretalx	pip	< 2.3.2	2.3.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The commit diff shows critical security checks were added to both functions:

In dump_content: Added path.resolve() and parent directory validation to prevent traversal
In get_mediastatic_content: Added path resolution and containment checks for MEDIA/STATIC_ROOT These changes directly address CWE-22 (Path Traversal). The Sonar blog explicitly describes how these functions processed attacker-controlled paths without proper validation, enabling file read/write primitives. The vulnerability documentation and patch context leave no ambiguity about their role in the exploit chain.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

6.5

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2023-28459: pretalx vulnerable to path traversal in HTML export

CVE-2023-28459:

6.5

-

Basic Information

Basic Information

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

CVE-2023-28459: pretalx vulnerable to path traversal in HTML export

Basic Information

Basic Information

6.5

6.5

Technical Details

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI