CVE-2023-34407: Harbingergroup Office Player

High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days.

OfflinePlayerService.exe in Harbinger Offline Player 4.0.6.0.2 allows directory traversal as LocalSystem via ..\ in a URL.

Affected products

• Harbingergroup Office Player: version 4.0.6.0.2 only

Published 2023-06-05. Last modified 2026-06-17.