Vulnerability record · CVE-2023-42803 · published 30 October 2023

CVE-2023-42803: Bigbluebutton unrestricted file upload vulnerability

Bigbluebutton · Bigbluebutton

BigBlueButton is an open-source virtual classroom. BigBlueButton prior to version 2.6.0-beta.2 is vulnerable to unrestricted file upload, where the insertDocument API call does not validate the given file extension before saving the file, and does not remove it in case of validation failures. BigBlueButton 2.6.0-beta.2 contains a patch. There are no known workarounds.

8.8 CVSS 3.1 High EPSS 0.54% · top 56.9% CWE-434 · Unrestricted file upload

8.8CVSS 3.1 base score

0.54%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

4References

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Bigbluebutton Bigbluebutton

References

Link	Tags
https://github.com/bigbluebutton/bigbluebutton/pull/15990	Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-w98f-6x8w-xhjc	Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/pull/15990	Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-w98f-6x8w-xhjc	Third Party Advisory

Track CVE-2023-42803 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2020-27602Bigbluebutton injection vulnerabilityBigBlueButton before 2.2.7 does not have a protection mechanism for separator injection in meetingId, userId, and authToken.EPSS 1.4%29 Sep 2022 9.8CVE-2020-27605Bigbluebutton vulnerabilityBigBlueButton through 2.2.28 uses Ghostscript for processing of uploaded EPS documents, and consequently may be subject to attacks related to a "schw…EPSS 1.2%21 Oct 2020 9.8CVE-2020-12443Bigbluebutton path traversal vulnerabilityBigBlueButton before 2.2.6 allows remote attackers to read arbitrary files because the presfilename (lowercase) value can be a .pdf filename while th…EPSS 3.7%29 Apr 2020 8.4CVE-2020-27613Bigbluebutton cleartext storage of sensitive data vulnerabilityThe installation procedure in BigBlueButton before 2.2.28 (or earlier) uses ClueCon as the FreeSWITCH password, which allows local users to achieve u…EPSS 0.27%21 Oct 2020 8.2CVE-2026-27466Bigbluebutton exposure of resource to wrong sphere vulnerabilityBigBlueButton is an open-source virtual classroom. In versions 3.0.21 and below, the official documentation for "Server Customization" on Support for…EPSS 0.58%21 Feb 2026 7.5CVE-2025-61601Bigbluebutton vulnerabilityBigBlueButton is an open-source virtual classroom. A Denial of Service (DoS) vulnerability in versions prior to 3.0.13 allows any authenticated user …EPSS 0.47%9 Oct 2025 7.5CVE-2025-61602Bigbluebutton vulnerabilityBigBlueButton is an open-source virtual classroom. A denial-of-service (DoS) vulnerability in versions prior to 3.0.13 allows any authenticated user …EPSS 0.39%9 Oct 2025 7.5CVE-2022-23488Bigbluebutton information exposure vulnerabilityBigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6 are vulnerable to Insertion of Sensitive Information Into Sent Da…EPSS 0.60%17 Dec 2022

Source: NIST National Vulnerability Database (record CVE-2023-42803), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.