Vulnerability Database

319,592

Total vulnerabilities in the database

CVE-2023-42803

BigBlueButton is an open-source virtual classroom. BigBlueButton prior to version 2.6.0-beta.2 is vulnerable to unrestricted file upload, where the insertDocument API call does not validate the given file extension before saving the file, and does not remove it in case of validation failures. BigBlueButton 2.6.0-beta.2 contains a patch. There are no known workarounds.

  • Published: Oct 30, 2023
  • Updated: Nov 16, 2025
  • CVE: CVE-2023-42803
  • Severity: Medium
  • Exploit:

CVSS v3:

  • Severity: Medium
  • Score: 5.3
  • AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

CWEs:

Software From Fixed in
bigbluebutton / bigbluebutton 2.6.0-alpha4 2.6.0-alpha4.x
bigbluebutton / bigbluebutton 2.6.0-alpha1 2.6.0-alpha1.x
bigbluebutton / bigbluebutton 2.6.0-alpha2 2.6.0-alpha2.x
bigbluebutton / bigbluebutton 2.6.0-alpha3 2.6.0-alpha3.x
bigbluebutton / bigbluebutton - 2.5.18.x
bigbluebutton / bigbluebutton 2.6.0-beta1 2.6.0-beta1.x