CVE-2023-42335

HIGH 8.8CVE-2023-42335 · Published 20/09/2023 · updated 17/06/2026

In short

CVE-2023-42335 is a HIGH (CVSS 8.8) vulnerability affecting crew (fl3xx), dispatch (fl3xx).
Chance of exploitation in the next 30 days (EPSS): 1.3%, higher than 71.1% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
crew fl3xx	`= 2.10.37`	No fix yet
dispatch fl3xx	`= 2.10.37`	No fix yet

Description

Unrestricted File Upload vulnerability in Fl3xx Dispatch 2.10.37 and fl3xx Crew 2.10.37 allows a remote attacker to execute arbitrary code via the add attachment function in the New Expense component.

References

0xhunter20.medium.com/how-i-found-unrestricted-file-upload-in-fl3xx-ios-app-cve-2023-42335-6b1a72da6d65 · Exploit

More vulnerabilities in crew

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free