Vulnerability record · CVE-2023-32166 · published 3 May 2024
CVE-2023-32166: D-Link D-View uploadFile path traversal allows arbitrary file creation
Dlink · D View 8
D-Link D-View contains a path traversal flaw in the uploadFile function, where a user-supplied path is used in file operations without proper validation. An authenticated remote attacker can exploit this to create arbitrary files on the server. The vulnerability has a CVSS 3.0 score of 8.1 (High) and is tracked as CWE-22.
Description
D-Link D-View uploadFile Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of D-Link D-View. Authentication is required to exploit this vulnerability. The specific flaw exists within the uploadFile function. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to create files in the context of SYSTEM. Was ZDI-CAN-19527.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Automated analysis
high priorityCVSS 8.1 with high EPSS and potential for SYSTEM-level file creation, though authentication is required.
What it is
D-Link D-View contains a path traversal flaw in the uploadFile function, where a user-supplied path is used in file operations without proper validation. An authenticated remote attacker can exploit this to create arbitrary files on the server. The vulnerability has a CVSS 3.0 score of 8.1 (High) and is tracked as CWE-22.
Impact
An attacker can create files in the context of SYSTEM, potentially leading to code execution or system compromise. The CVSS vector shows high integrity and availability impact, with no confidentiality impact.
Attack surface
The flaw is reachable remotely over the network via the uploadFile function, requiring low privileges (authenticated user) and no user interaction. The CVSS vector is AV:N/AC:L/PR:L/UI:N.
Exploitation
The vulnerability is not listed in CISA KEV, but EPSS indicates a 30-day exploitation probability of 0.74302 (99.465th percentile). References include vendor and third-party advisories, but no public exploit code is mentioned.
What to do
- Apply the vendor patch from D-Link advisory SAP10332 as soon as possible.
- Restrict network access to the D-View management interface to trusted hosts only.
- Enforce least privilege for D-View user accounts to limit authenticated attack surface.
- Monitor file creation events in D-View installation directories for unexpected files.
Detection
- Monitor for unusual file creation in D-View directories, especially files with system or executable extensions.
- Audit D-View logs for uploadFile requests containing path traversal sequences (e.g., ../).
- Alert on file writes occurring outside expected upload directories.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10332 | Vendor Advisory |
| https://www.zerodayinitiative.com/advisories/ZDI-23-717/ | Third Party Advisory |
| https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10332 | Vendor Advisory |
| https://www.zerodayinitiative.com/advisories/ZDI-23-717/ | Third Party Advisory |
Track CVE-2023-32166 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2023-32166), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
