CVE-2023-22726

Description

act vulnerable to arbitrary file upload in artifact server in github.com/nektos/act

How to fix CVE-2023-22726

To remediate CVE-2023-22726, upgrade the affected package to a fixed version below.

• Go/github.com/nektos/act—upgrade to 0.2.40 or later
• Go/github.com/nektos/act—upgrade to 0.2.40 or later

Is CVE-2023-22726 being exploited?

Low — EPSS is 1.5%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, < 0.2.40
• from 0, < 0.2.40

CVSS scores

References (10)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-22726
• ADVISORYsecuritylab.github.com/advisories/GHSL-2023-004_act
• PATCHgithub.com/nektos/act
• WEBgithub.com/nektos/act/blob/master/pkg/artifacts/server.go#L65
• WEB