High
Security advisory
A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged runtime user. Users and attackers could run system commands with limited privilege to gain unauthorized access to confidential information and potentially violate integrity by modifying resources. The template engine has been reconfigured to deny execution of harmful commands on a system level. No publicly available exploits are known.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2023-29048
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 2 Nov 2026, 16:42 UTC · Revision 1
Source evidence
A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged runtime user. Users and attackers could run system commands with limited privilege to gain unauthorized access to confidential information and potentially violate integrity by modifying resources. The template engine has been reconfigured to deny execution of harmful commands on a system level. No publicly available exploits are known.
osv:CVE-2023-29048
Complete source record
{
"id": "cbfdb515079a833c1c0daf1e85619735189b46fb3d55f92cb8702a196535a509",
"url": "https://osv.dev/vulnerability/CVE-2023-29048",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2023-29048",
"summary": "A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged runtime user. Users and attackers could run system commands with limited privilege to gain unauthorized access to confidential information and potentially violate integrity by modifying resources. The template engine has been reconfigured to deny execution of harmful commands on a system level. No publicly available exploits are known.",
"evidence": "osv:CVE-2023-29048",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2023-29048",
"aliases": [
"CVE-2023-29048"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/open-xchange/appsuite-frontend",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "489e7d0bf2bb0dc4c984860c4ce6f4d772086875"
},
{
"introduced": "489e7d0bf2bb0dc4c984860c4ce6f4d772086875"
},
{
"last_affected": "8552612bd1f09c300884661303a0ec515f7d3bd5"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "7.10.6"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:-:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-NA"
},
{
"last_affected": "7.10.6-NA"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev10:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev10"
},
{
"last_affected": "7.10.6-rev10"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev11:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev11"
},
{
"last_affected": "7.10.6-rev11"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev12:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev12"
},
{
"last_affected": "7.10.6-rev12"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev13:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev13"
},
{
"last_affected": "7.10.6-rev13"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev14:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev14"
},
{
"last_affected": "7.10.6-rev14"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev15:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev15"
},
{
"last_affected": "7.10.6-rev15"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev16:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev16"
},
{
"last_affected": "7.10.6-rev16"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev17:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev17"
},
{
"last_affected": "7.10.6-rev17"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev18:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev18"
},
{
"last_affected": "7.10.6-rev18"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev19:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev19"
},
{
"last_affected": "7.10.6-rev19"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev20:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev20"
},
{
"last_affected": "7.10.6-rev20"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev21:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev21"
},
{
"last_affected": "7.10.6-rev21"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev22:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev22"
},
{
"last_affected": "7.10.6-rev22"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev23:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev23"
},
{
"last_affected": "7.10.6-rev23"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev24:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev24"
},
{
"last_affected": "7.10.6-rev24"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev25:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev25"
},
{
"last_affected": "7.10.6-rev25"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev26:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev26"
},
{
"last_affected": "7.10.6-rev26"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev27:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev27"
},
{
"last_affected": "7.10.6-rev27"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev28:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev28"
},
{
"last_affected": "7.10.6-rev28"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev29:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev29"
},
{
"last_affected": "7.10.6-rev29"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev30:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev30"
},
{
"last_affected": "7.10.6-rev30"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev31:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev31"
},
{
"last_affected": "7.10.6-rev31"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev32:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev32"
},
{
"last_affected": "7.10.6-rev32"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev33:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev33"
},
{
"last_affected": "7.10.6-rev33"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev34:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev34"
},
{
"last_affected": "7.10.6-rev34"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev35:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev35"
},
{
"last_affected": "7.10.6-rev35"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev36:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev36"
},
{
"last_affected": "7.10.6-rev36"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev37:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev37"
},
{
"last_affected": "7.10.6-rev37"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev50:*:*:*:*:*:*",
"range": [
{
"introduced": "7.10.6-rev50"
},
{
"last_affected": "7.10.6-rev50"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"7.10.6-NA",
"7.10.6-rev10",
"7.10.6-rev11",
"7.10.6-rev12",
"7.10.6-rev13",
"7.10.6-rev14",
"7.10.6-rev15",
"7.10.6-rev16",
"7.10.6-rev17",
"7.10.6-rev18",
"7.10.6-rev19",
"7.10.6-rev20",
"7.10.6-rev21",
"7.10.6-rev22",
"7.10.6-rev23",
"7.10.6-rev24",
"7.10.6-rev25",
"7.10.6-rev26",
"7.10.6-rev27",
"7.10.6-rev28",
"7.10.6-rev29",
"7.10.6-rev30",
"7.10.6-rev31",
"7.10.6-rev32",
"7.10.6-rev33",
"7.10.6-rev34",
"7.10.6-rev35",
"7.10.6-rev36",
"7.10.6-rev37",
"7.10.6-rev50",
"7.10.6-50",
"7.10.6-21",
"as-next",
"7.10.5-2",
"7.10.5-1",
"7.10.5-0",
"7.10.4-1",
"7.10.4-0",
"7.10.3-0",
"7.10.0-2",
"7.10.0-0",
"7.8.3-10",
"7.8.3-9",
"7.8.2-16",
"7.8.2-14",
"7.8.2-9",
"7.8.2-7",
"7.8.2-6",
"7.8.2-5",
"7.8.1-14",
"7.8.1-11",
"7.8.1-10",
"7.8.0-19",
"7.8.0-12",
"7.8.0-11",
"7.8.0-10",
"7.8.0-8",
"7.8.0-7",
"7.6.2-24",
"7.6.2-23",
"7.6.2-22",
"7.6.2-19",
"7.6.2-18",
"7.6.2-16",
"7.6.2-13",
"7.4.1-6"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-29048.json"
}
}
],
"modified": "2026-10-28T02:30:20.922572120Z",
"provider": "osv",
"references": [
"https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0005.json",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29048.json",
"https://nvd.nist.gov/vuln/detail/CVE-2023-29048",
"https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6248_7.10.6_2023-09-19.pdf"
],
"provider_metadata": {
"cwe_ids": [
"CWE-78"
],
"cna_assigner": "OX",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"last_affected": "7.10.6-rev50"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29048.json"
}
},
"related_cves": [
{
"value": "CVE-2023-29048",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 487309,
"published_at": "2024-01-08T08:51:31.461+00:00"
}