CVE-2023-7305CWE-434unrestricted-file-upload

CVE-2023-7305

published October 15, 2025

CVSS
9.2
EPSS
1%
Percentile
44.1
In the wild
Unconfirmed
What it is

SmartBI V8, V9, and V10 contain an unrestricted file upload vulnerability via the RMIServlet request handling logic. Under certain configurations or usage patterns, attackers can send specially crafted requests that cause the application to perform sensitive operations or execute arbitrary code on the host. The vendor released a fix in July 2023 to address the underlying flaw. VulnCheck has observed this vulnerability being exploited in the wild.

The record
Technical detail
CVSS
9.2 · NONE
CVSS v4.0
Not supplied
EPSS
0.00532 · 44.1th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2025-10-15T06:15Z
References (4)
https://avd.aliyun.com/detail?id=AVD-2023-1673292 · [email protected]https://jeyiuwai.pages.dev/posts/1day-%E8%B7%9F%E8%B8%AAsmartbi-rmiservlet-%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E/ · [email protected]https://www.smartbi.com.cn/patchinfo · [email protected]https://www.vulncheck.com/advisories/smartbi-rmiservlet-unrestricted-file-upload-rce · [email protected]
EPSS history
Timeline
  • 15 OCT 01:24Z
    SmartBI RMIServlet Unrestricted File Upload RCE
    cvelistv5