CVE-2023-7305

SmartBI RMIServlet Unrestricted File Upload RCE

State: Published
Severity: 9.2 Critical
Published: Oct 15, 2025
Updated: Nov 7, 2025
Reserved: Jul 24, 2025

Description

SmartBI V8, V9, and V10 contain an unrestricted file upload vulnerability via the RMIServlet request handling logic. Under certain configurations or usage patterns, attackers can send specially crafted requests that cause the application to perform sensitive operations or execute arbitrary code on the host. The vendor released a fix in July 2023 to address the underlying flaw. VulnCheck has observed this vulnerability being exploited in the wild.

Scores

CVSS	Score	Vector	Source
4.0	9.2 Critical	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	VulnCheck

Weaknesses

CWE-434 Unrestricted Upload of File with Dangerous Type

Affected Products

Product	Versions
SmartBIGuangzhou Smart Software Co., Ltd.	V8 to before July 2023 updateAffected V9 to before July 2023 updateAffected V10 to before July 2023 updateAffected

References

https://www.smartbi.com.cn/patchinforelease-notespatch
https://avd.aliyun.com/detail?id=AVD-2023-1673292vdb-entry
https://jeyiuwai.pages.dev/posts/1day-%E8%B7%9F%E8%B8%AAsmartbi-rmiservlet-%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E/technical-descriptionexploit
https://www.vulncheck.com/advisories/smartbi-rmiservlet-unrestricted-file-upload-rcethird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.