CVE-2023-42335

8.8 highEPSS 1.3%

High (8.8) in fl3xx. EPSS 1.3% chance of exploitation in the next 30 days.

Unrestricted File Upload vulnerability in Fl3xx Dispatch 2.10.37 and fl3xx Crew 2.10.37 allows a remote attacker to execute arbitrary code via the add attachment function in the New Expense component.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.3% chance of exploitation in the next 30 days; higher than 71% of CVEs (scores of 2026-10-31)
CWE: CWE-434
Published: 2023-09-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

fl3xx:crew
fl3xx:dispatch

References

https://0xhunter20.medium.com/how-i-found-unrestricted-file-upload-in-fl3xx-ios-app-cve-2023-42335-6b1a72da6d65
https://0xhunter20.medium.com/how-i-found-unrestricted-file-upload-in-fl3xx-ios-app-cve-2023-42335-6b1a72da6d65

Check your stack JSON