CVE-2023-2859

HIGH

Code Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.9.

Affects 1 product across 1 vendor.

CVSS 3.18.8
EPSS1.6%
Percentile76th
PatchPatched
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, requires user interaction, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-94: Code Injection

Attacker injects arbitrary code that is executed by the application process.

Related Attack Patterns (CAPEC)
CAPEC-35 Leverage Executable Code in Non-Executable Files
via CWE-94
CAPEC-77 Manipulating User-Controlled Variables
via CWE-94
CAPEC-242 Code Injection
via CWE-94

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A critical code injection vulnerability exists in the TeamPass application hosted on GitHub repository nilsteampassnet/teampass prior to version 3.0.9. This vulnerability could allow an attacker to execute arbitrary code on the server, leading to unauthorized access, data theft, or system compromise.

BSID: BS-2023-GLOBAL-261681-H • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2023-2859?
A critical code injection vulnerability exists in the TeamPass application hosted on GitHub repository nilsteampassnet/teampass prior to version 3.0.9. This vulnerability could allow an attacker to execute arbitrary code on the server, leading to unauthorized access, data theft, or system compromise.
What is the CVSS score for CVE-2023-2859?
CVE-2023-2859 has CVSS 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS: 1.6%.
Is CVE-2023-2859 actively exploited?
No confirmed active exploitation of CVE-2023-2859 as of 2026-05-30.
How do I remediate CVE-2023-2859?
Priority: IMMEDIATE.
What systems are affected by CVE-2023-2859?
CVE-2023-2859 affects Teampass Teampass.
Vulnerability Details
CVE IDCVE-2023-2859
BSIDBS-2023-GLOBAL-261681-H BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published2023-05-24
Last Modified2024-11-21
ICS Relevance15%
Weakness (CWE)
Code Injection
SourceNVD
Official Description

Code Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.9.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability arises from improper validation of user input, specifically in the handling of certain parameters in the application. An attacker can exploit this by injecting malicious code through a crafted request, which the application then executes with the privileges of the web server.

Exploitation Likelihood: HIGH

Affected Products
VendorProductAffected Versions
Teampass Teampass < 3.0.9
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 1241 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hashe60a9105f1eb3591704193f6437f217ce1aed0b77b5dd85a9aa7dca0ec46d4fe0f98023e5b1834d82e681fac6d8509aa5008c5f739d7935cc8f00aa6193ab75e
Related CVEs affecting Teampass
CVE-2015-7564 9.8 Multiple SQL injection vulnerabilities in TeamPass 2.1.24 and earlier allow r... CVE-2019-1000001 9.8 TeamPass version 2.1.27 and earlier contains a Storing Passwords in a Recover... CVE-2017-9436 9.8 TeamPass before 2.1.27.4 is vulnerable to a SQL injection in users.queries.php. CVE-2023-3086 9.0 Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/team... CVE-2015-7563 8.8 Cross-site request forgery (CSRF) vulnerability in TeamPass 2.1.24 and earlie...
View all Teampass CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →