Vulnerability record · CVE-2023-42804 · published 30 October 2023

CVE-2023-42804: Bigbluebutton path traversal vulnerability

Bigbluebutton · Bigbluebutton

BigBlueButton is an open-source virtual classroom. BigBlueButton prior to version 2.6.0-beta.1 has a path traversal vulnerability that allows an attacker with a valid starting folder path, to traverse and read other files without authentication, assuming the files have certain extensions (txt, swf, svg, png). In version 2.6.0-beta.1, input validation was added on the parameters being passed and dangerous characters are stripped. There are no known workarounds.

5.3 CVSS 3.1 Medium EPSS 0.46% · top 62.8% CWE-22 · Path traversal

5.3CVSS 3.1 base score

0.46%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

4References

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Bigbluebutton Bigbluebutton

References

Link	Tags
https://github.com/bigbluebutton/bigbluebutton/pull/15960	Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-3qjg-229m-vq84	Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/pull/15960	Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-3qjg-229m-vq84	Third Party Advisory

Track CVE-2023-42804 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2020-27602Bigbluebutton injection vulnerabilityBigBlueButton before 2.2.7 does not have a protection mechanism for separator injection in meetingId, userId, and authToken.EPSS 1.4%29 Sep 2022 9.8CVE-2020-27605Bigbluebutton vulnerabilityBigBlueButton through 2.2.28 uses Ghostscript for processing of uploaded EPS documents, and consequently may be subject to attacks related to a "schw…EPSS 1.2%21 Oct 2020 9.8CVE-2020-12443Bigbluebutton path traversal vulnerabilityBigBlueButton before 2.2.6 allows remote attackers to read arbitrary files because the presfilename (lowercase) value can be a .pdf filename while th…EPSS 3.7%29 Apr 2020 8.8CVE-2023-42803Bigbluebutton unrestricted file upload vulnerabilityBigBlueButton is an open-source virtual classroom. BigBlueButton prior to version 2.6.0-beta.2 is vulnerable to unrestricted file upload, where the i…EPSS 0.54%30 Oct 2023 8.4CVE-2020-27613Bigbluebutton cleartext storage of sensitive data vulnerabilityThe installation procedure in BigBlueButton before 2.2.28 (or earlier) uses ClueCon as the FreeSWITCH password, which allows local users to achieve u…EPSS 0.27%21 Oct 2020 8.2CVE-2026-27466Bigbluebutton exposure of resource to wrong sphere vulnerabilityBigBlueButton is an open-source virtual classroom. In versions 3.0.21 and below, the official documentation for "Server Customization" on Support for…EPSS 0.58%21 Feb 2026 7.5CVE-2025-61601Bigbluebutton vulnerabilityBigBlueButton is an open-source virtual classroom. A Denial of Service (DoS) vulnerability in versions prior to 3.0.13 allows any authenticated user …EPSS 0.47%9 Oct 2025 7.5CVE-2025-61602Bigbluebutton vulnerabilityBigBlueButton is an open-source virtual classroom. A denial-of-service (DoS) vulnerability in versions prior to 3.0.13 allows any authenticated user …EPSS 0.39%9 Oct 2025

Source: NIST National Vulnerability Database (record CVE-2023-42804), CISA KEV, FIRST EPSS (scores of 2026-09-30). This page is refreshed as NVD updates the record.