CVE-2023-35801 in FME Server
Summary
by MITRE • 06/23/2023
A directory traversal vulnerability in Safe Software FME Server before 2022.2.5 allows an attacker to bypass validation when editing a network-based resource connection, resulting in the unauthorized reading and writing of arbitrary files. Successful exploitation requires an attacker to have access to a user account with write privileges. FME Flow 2023.0 is also a fixed version.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 01/10/2026
The directory traversal vulnerability identified as CVE-2023-35801 affects Safe Software FME Server versions prior to 2022.2.5 and FME Flow 2023.0, representing a critical security flaw that undermines the integrity of network-based resource connections. This vulnerability stems from inadequate input validation mechanisms within the FME Server's connection editing functionality, allowing malicious actors to manipulate file paths and gain unauthorized access to system resources. The flaw specifically impacts the server's ability to properly validate and sanitize user-supplied path data when establishing or modifying network connections, creating a pathway for attackers to bypass intended security controls.
The technical implementation of this vulnerability operates through a classic directory traversal attack pattern where an attacker can manipulate the path resolution mechanism to access files outside the intended directory structure. When a user with write privileges attempts to edit a network-based resource connection, the system fails to properly validate the input parameters, enabling path manipulation through techniques such as directory traversal sequences. This weakness is categorized under CWE-22, which specifically addresses improper limitation of a pathname to a restricted directory, commonly known as path traversal or directory traversal attacks. The vulnerability manifests when the application processes user-controllable input without adequate sanitization, allowing attackers to construct malicious paths that can access arbitrary files on the server filesystem.
The operational impact of CVE-2023-35801 extends beyond simple data theft, as it enables both unauthorized reading and writing operations across the affected system. Attackers with valid user accounts possessing write privileges can exploit this vulnerability to read sensitive configuration files, access proprietary data, modify critical system files, or even inject malicious code into the server environment. This capability significantly increases the potential damage scope, as it allows for both information disclosure and system compromise. The vulnerability particularly affects organizations that rely heavily on FME Server for data integration and processing workflows, where the compromise of connection configurations could lead to widespread data exposure or operational disruption. The attack vector requires only a valid user account with write permissions, making it particularly dangerous in environments where privilege escalation is not adequately controlled.
Mitigation strategies for CVE-2023-35801 primarily focus on applying the vendor-provided patches and updates, specifically upgrading to FME Server 2022.2.5 or FME Flow 2023.0, which contain the necessary fixes for the directory traversal vulnerability. Organizations should also implement additional defensive measures including strict input validation on all user-controllable parameters, implementing proper path sanitization routines, and establishing robust access control mechanisms that limit write privileges to only essential personnel. Network segmentation and monitoring solutions should be deployed to detect anomalous file access patterns that may indicate exploitation attempts. The vulnerability's classification under ATT&CK technique T1059.007 for command and script interpreter and T1566.001 for spearphishing attachment demonstrates its potential for lateral movement and privilege escalation within compromised environments. Security teams should also consider implementing principle of least privilege access controls and regular security audits of connection configurations to prevent unauthorized modifications that could exploit this vulnerability.