{"id":"CVE-2023-41266","published":"2023-08-29T23:15:09Z","modified":"2026-08-05T05:16:40Z","title":"Qlik Sense Path Traversal Vulnerability","vendor":"Qlik","product":"Sense","tier":"core","eol":null,"description":{"text":"A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows an unauthenticated remote attacker to generate an anonymous session. This allows them to transmit HTTP requests to unauthorized endpoints. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.","provenance":"source","from":"NVD"},"summary":{"text":"A path traversal flaw in Qlik Sense Enterprise for Windows lets an attacker reach unauthorized endpoints by abusing how the product handles pathnames. An unauthenticated remote attacker with network access, requiring no user interaction and no authentication, can generate an anonymous session and use it to send HTTP requests to endpoints they should not be able to access.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T08:31:32Z"},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.84843,"percentile":0.99709,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2023-12-07","dueDate":"2023-12-28","ransomware":true,"requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","notes":"https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801  ;  https://nvd.nist.gov/vuln/detail/CVE-2023-41266","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-11-28","exploitedFirstSeen":"2023-11-28","ransomware":true,"evidence":[{"url":"https://www.arcticwolf.com/resources/blog/qlik-sense-exploited-in-cactus-ransomware-campaign/","date":"2023-11-28"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-12-07"},{"url":"https://research.checkpoint.com/2024/magnet-goblin-targets-publicly-facing-servers-using-1-day-vulnerabilities/","date":"2024-03-08"},{"url":"https://blog.fox-it.com/2024/04/25/sifting-through-the-spines-identifying-potential-cactus-ransomware-victims/","date":"2024-04-25"},{"url":"https://northwave-cybersecurity.com/whitepapers-articles/pricksense-how-cactus-exploits-qlik-sense","date":"2024-04-25"},{"url":"https://www.trustwave.com/hubfs/Web/Library/Documents_pdf/2024_Trustwave_Professional_Services_Sector_Threat_Landscape.pdf","date":"2024-06-26"},{"url":"https://www.shadowserver.org/what-we-do/network-reporting/compromised-website-report/","date":"2025-02-05"},{"url":"https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/67b5c5f85bac8f34e1b44d35_Darktrace%20Annual%20Threat%20Report%202024.pdf","date":"2025-02-19"}],"evidenceTotal":8,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"},{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801","tags":["Vendor Advisory"]},{"url":"https://community.qlik.com/t5/Release-Notes/tkb-p/ReleaseNotes","tags":["Release Notes"]},{"url":"https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801","tags":["Vendor Advisory"]},{"url":"https://community.qlik.com/t5/Release-Notes/tkb-p/ReleaseNotes","tags":["Release Notes"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41266","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: unauthenticated remote exploitation of public-facing app","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows an unauthenticated remote attacker to generate an anonymous session","start":225,"end":299}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: unauthorized request access does not prove code execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows them to transmit HTTP requests to unauthorized endpoints","start":306,"end":369}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-45783","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-45783","exploited":true,"exploitedSince":"2023-12-07","provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2023-41266","name":"Qlik Sense Enterprise - Path Traversal","severity":"medium","path":"http/cves/2023/CVE-2023-41266.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-41266.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2023-08-29","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-41266","provenance":"source"},{"date":"2023-11-28","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.arcticwolf.com/resources/blog/qlik-sense-exploited-in-cactus-ransomware-campaign/","provenance":"source"},{"date":"2023-12-07","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-12-07","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-45783","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":100},"priority":{"score":77.5,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1067 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.94,"detail":"percentile 0.9971"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":4.55,"detail":"base score 6.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}