CVE-2023-26045: Path traversal and code execution in nodebb
Summary
CVE-2023-26045: Path traversal and code execution via prototype vulnerability. Affects nodebb versions >= 2.5.0, < 2.8.7. Fixed in 2.8.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NodeBB is an open-source forum software built on Node.js and MongoDB. It provides a platform for creating online communities and discussion boards. The vulnerability identified in NodeBB allows for path traversal and code execution through a prototype vulnerability.
Vulnerability Detail
The vulnerability arises from the use of the object destructuring assignment syntax in the user export code path, combined with a path traversal vulnerability. An attacker can exploit this by crafting a payload that invokes the user export logic, leading to the arbitrary execution of JavaScript files on the local disk. This can result in unauthorized access, data leakage, and potential remote code execution.
How To Fix
Latest published version: 1.4.0 as of 23 Oct 2026
npm install nodebb@1.4.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.8.7
This is the first release that contains the fix.
npm install nodebb@2.8.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
A workaround for this vulnerability is to apply the patch mentioned above. Site maintainers can follow these steps to manually apply the patch:
- Identify the affected code in the user export logic.
- Replace the vulnerable code with the patched code from commit ec58700f6dff8e5b4af1544f6205ec362b593092.
- Test the updated code to ensure the vulnerability is mitigated.
Conclusion
The path traversal and code execution vulnerability in NodeBB can have severe consequences, including unauthorized access, data leakage, and potential remote code execution. It is crucial to update NodeBB to version 2.8.7 or later, or manually apply the provided patch, to mitigate this vulnerability. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nodebb →
FAQ
The impact of this vulnerability is that an attacker can execute arbitrary JavaScript files on the local disk, potentially leading to unauthorized access, data leakage, and remote code execution.
You can use the Vulert Playground at Vulert Scanner to check if your NodeBB installation is affected by this vulnerability. Simply provide your package-lock.json file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
At the time of this advisory, there are no known public exploits for this vulnerability. However, it is important to patch your NodeBB installation to prevent any potential exploitation.
Yes, this vulnerability can be exploited remotely. An attacker can craft a payload and send it to a vulnerable NodeBB instance, triggering the path traversal and code execution.
The recommended mitigation is to update NodeBB to version 2.8.7 or later. However, if updating is not immediately feasible, applying the provided patch manually can help mitigate the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodebb.
