NewA calmer, faster ZeroHour — security assessments on articles, story timelines and search from any page.

CVE-2023-36460

CVSS 3.1: 9.9 critical
EPSS: 40%p99
Published: Jul 6, 2023 · Jul 6, 2023
Modified: Jun 17, 2026

Analyze CVE-2023-36460 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 3.5.0 and prior to versions 3.5.9, 4.0.5, and 4.1.3, attackers using carefully crafted media files can cause Mastodon's media processing code to create arbitrary files at any location. This allows attackers to create and overwrite any file Mastodon has access to, allowing Denial of Service and arbitrary Remote Code Execution. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue.

Vendors: joinmastodon

Products: mastodon

Weakness: CWE-22

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (40.1%)

In the news

5 stories

Lagging Mastodon admins urged to patch critical account takeover flaw (CVE-2024-23832)

Help Net SecurityFeb 18, 20:22 UTC · Feb 18, 2024VulnerabilityCVE-2024-23832 CVE-2023-364602

60

Mastodon fixed a flaw that can allow take over of any account

Security AffairsFeb 3, 15:40 UTC · Feb 3, 2024Exploit / PoCCVE-2024-23832 CVE-2023-364602 · 1 read

60

Mastodon Vulnerability Allows Hackers to Hijack Any Decentralized Account

The Hacker NewsFeb 3, 06:51 UTC · Feb 3, 2024VulnerabilityCVE-2024-23832 CVE-2023-364602 · 1 read

60

Mastodon Social Network Patches Critical Flaws Allowing Server Takeover

The Hacker NewsJul 7, 12:55 UTC · Jul 7, 2023VulnerabilityCVE-2023-36460 CVE-2023-364592

60

Mastodon fixes critical “TootRoot” vulnerability allowing node hijacking

Ars Technica · SecurityJul 6, 19:45 UTC · Jul 6, 2023VulnerabilityCVE-2023-364601 · 1 read

60