CVE-2023-46865: Craterapp Crater

High severity, CVSS 7.2. EPSS: 20.3% chance of exploitation in the next 30 days.

/api/v1/company/upload-logo in CompanyController.php in crater through 6.0.6 allows a superadmin to execute arbitrary PHP code by placing this code into an image/png IDAT chunk of a Company Logo image.

Affected products

• Craterapp Crater: up to and including 6.0.6

Published 2023-10-30. Last modified 2026-06-17.