CVE-2023-45303: Thingsboard

High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days.

ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute (for content sent to the /api/admin/settings endpoint).

Affected products

• Thingsboard Thingsboard: before 3.5 (fixed in 3.5)

Published 2023-10-06. Last modified 2026-06-17.