Live › vulnerability › CVE-2023-32321
Go to dashboardCKAN's resource_create and package_update actions accept crafted resource ids that write uploaded files to arbitrary locations, and Beaker's file session store unpickles data unsafely, so a dataset editor can reach remote code execution. The same flaw lets users read and overwrite resources they cannot access.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 16:30 UTC, 0h before NVD. All times on this page are UTC.
CKAN instances where users can create or edit datasets and resources, which includes most public and internal data portals. The code execution path needs Beaker's file session store, so deployments using other session backends are exposed only to the file write and data access flaws. Installations that are read-only or already on a fixed version can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| ckan | pypi | < 2.9.9 | 2.9.9 |
| ckan | pypi | = 2.10.0 | 2.10.1 |
| okfn ckan | vendor | >= 2.9.0, < 2.9.9 | 2.9.9 |
| okfn ckan | vendor | = 2.10.0 | – |
pip show ckan and compare it to the fixed releasessession.type in the CKAN config; if it is file with Beaker, the remote code execution path is open2.9.9 or 2.10.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
CKAN is an open-source data management system for powering data hubs and data portals. Multiple vulnerabilities have been discovered in Ckan which may lead to remote code execution. An arbitrary file write in resource_create and package_update actions, using the ResourceUploader object. Also reachable via package_create, package_revise, and package_patch via calls to package_update. Remote code execution via unsafe pickle loading, via Beaker's session store when configured to use the file session store backend. Potential DOS due to lack of a length check on the resource id. Information disclosure: A user with permission to create a resource can access any other resource on the system if they know the id, even if they don't have access to it. Resource overwrite: A user with permission to create a resource can overwrite any resource if they know the id, even if they don't have access to it. A user with permissions to create or edit a dataset can upload a resource with a specially crafted id to write the uploaded file in an arbitrary location. This can be leveraged to Remote Code Execution via Beaker's insecure pickle loading. All the above listed vulnerabilities have been fixed in CKAN 2.9.9 and CKAN 2.10.1. Users are advised to upgrade. There are no known workarounds for these issues.
This page as .md · .json · in your agent: get_signal("CVE-2023-32321")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.