← Vulnerability feed

Vulnerability record · CVE-2023-37378 · published 3 July 2023

CVE-2023-37378: Nullsoft scriptable install system vulnerability

Nullsoft · Nullsoft Scriptable Install System

Nullsoft Scriptable Install System (NSIS) before 3.09 mishandles access control for an uninstaller directory.

5.3 CVSS 3.1 Medium EPSS 0.88% · top 42.4%
5.3CVSS 3.1 base score
0.88%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
19References
17 Jun 2026Last modified by NVD

Description

Nullsoft Scriptable Install System (NSIS) before 3.09 mishandles access control for an uninstaller directory.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://sf.net/p/nsis/bugs/1296 Issue TrackingPermissions Required
https://github.com/kichik/nsis/commit/281e2851fe669d10e0650fc89d0e7fb74a598967 Patch
https://github.com/kichik/nsis/commit/409b5841479c44fbf33a6ba97c1146e46f965467 Patch
https://github.com/kichik/nsis/commit/c40cf78994e74a1a3a381a850c996b251e3277c0 Patch
https://lists.debian.org/debian-lts-announce/2023/07/msg00005.html Mailing ListThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A65FBUMHLZ7GBV3VDKUB5EK
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OZPAAU57IA3NP6UOUXNBUQB
https://nsis.sourceforge.io/Docs/AppendixF.html#v3.09 Release Notes
https://sourceforge.net/p/nsis/news/2023/07/nsis-309-released/ Release Notes
http://sf.net/p/nsis/bugs/1296 Issue TrackingPermissions Required
https://github.com/kichik/nsis/commit/281e2851fe669d10e0650fc89d0e7fb74a598967 Patch
https://github.com/kichik/nsis/commit/409b5841479c44fbf33a6ba97c1146e46f965467 Patch
https://github.com/kichik/nsis/commit/c40cf78994e74a1a3a381a850c996b251e3277c0 Patch
https://lists.debian.org/debian-lts-announce/2023/07/msg00005.html Mailing ListThird Party Advisory
https://lists.debian.org/debian-lts-announce/2024/09/msg00013.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A65FBUMHLZ7GBV3VDKUB5EK
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OZPAAU57IA3NP6UOUXNBUQB
https://nsis.sourceforge.io/Docs/AppendixF.html#v3.09 Release Notes
https://sourceforge.net/p/nsis/news/2023/07/nsis-309-released/ Release Notes

Track CVE-2023-37378 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2026-42171Nullsoft scriptable install system uncontrolled search path element vulnerabilityNSIS (Nullsoft Scriptable Install System) 3.06.1 before 3.12 sometimes uses the Low IL temp directory when executing as SYSTEM, allowing local attack…EPSS 0.24%7.8CVE-2015-9268Nullsoft scriptable install system improper input validation vulnerabilityNullsoft Scriptable Install System (NSIS) before 2.49 has unsafe implicit linking against Version.dll. In other words, there is no protection mechani…EPSS 1.5%5.5CVE-2015-9267Nullsoft scriptable install system improper privilege management vulnerabilityNullsoft Scriptable Install System (NSIS) before 2.49 uses temporary folder locations that allow unprivileged local users to overwrite files. This al…EPSS 0.39%

Source: NIST National Vulnerability Database (record CVE-2023-37378), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.