CVE-2023-48193

9.8 criticalEPSS 2.0%

Critical (9.8) in fit2cloud jumpserver. EPSS 2.0% chance of exploitation in the next 30 days.

Insecure Permissions vulnerability in JumpServer GPLv3 v.3.8.0 allows a remote attacker to execute arbitrary code via bypassing the command filtering function. NOTE: this is disputed because command filtering is not intended to restrict what code can be run by authorized users who are allowed to execute files.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.0% chance of exploitation in the next 30 days; higher than 80% of CVEs (scores of 2026-10-31)
Published: 2023-11-28
Modified: 2026-07-09
Record from: the NVD, synced 2026-10-19

Affected

fit2cloud:jumpserver

References

https://blog.fit2cloud.com/?p=8cf83cd9-c23b-4625-9350-38926fb7f88e
https://github.com/296430468/lcc_test/blob/main/jumpserver_BUG.md
https://github.com/jumpserver/jumpserver
https://github.com/jumpserver/jumpserver/issues/13394
https://blog.fit2cloud.com/?p=8cf83cd9-c23b-4625-9350-38926fb7f88e

Check your stack JSON