CVE-2023-47104

CRITICAL 9.8CVE-2023-47104 · Published 30/10/2023 · updated 17/06/2026

In short

CVE-2023-47104 is a CRITICAL (CVSS 9.8) vulnerability affecting tinyfiledialogs (vareille).
Chance of exploitation in the next 30 days (EPSS): 0.86%, higher than 58.7% of all vulnerabilities.
Fix: update to 3.15.0 or later.

Package	Affected versions	Patched versions
tinyfiledialogs vareille	`< 3.15.0`	`3.15.0`

Description

tinyfiledialogs (aka tiny file dialogs) before 3.15.0 allows shell metacharacters (such as a backquote or a dollar sign) in titles, messages, and other input data. NOTE: this issue exists because of an incomplete fix for CVE-2020-36767, which only considered single and double quote characters.

References

servo/servo · Exploit
sourceforge.net/p/tinyfiledialogs/code/ci/ac9f9f6d8cdf45ca8d9b4cf1f201ee472301e114 · Patch

More vulnerabilities in tinyfiledialogs

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free