{
  "cveId": "CVE-2023-32637",
  "url": "https://patchblox.com/security/cve/CVE-2023-32637",
  "summary": "CVE-2023-32637 is fixed in gbrowse on 1 platform, first by DEBIAN-CVE-2023-32637, released July 25, 2023. It is not reported as exploited. Patch Radar priority: Urgent.",
  "title": "gbrowse: GBrowse accepts files with any formats uploaded and places them in the area accessible through unauthenticated web re...",
  "description": "GBrowse accepts files with any formats uploaded and places them in the area accessible through unauthenticated web requests. Therefore, anyone who can upload files through the product may execute arbitrary code on the server.",
  "published": "2023-07-25T06:15:10Z",
  "severity": "critical",
  "cvss": 9.8,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.0111,
  "epssPercentile": 0.66124,
  "priority": "Urgent",
  "priorityTier": 2,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "gbrowse",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "2.56\u002Bdfsg-1",
      "fix": "DEBIAN-CVE-2023-32637",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-32637",
      "released": "2023-07-25T06:15:10Z"
    },
    {
      "platform": "linux",
      "product": "gbrowse",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "2.56\u002Bdfsg-1",
      "fix": "DEBIAN-CVE-2023-32637",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-32637",
      "released": "2023-07-25T06:15:10Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}