CVE-2023-43662: ShokoServer is a media server which specializes in organizing anime. In affected versions the `/api/Image/WithPath` endpoint is accessible without…

PriorityP269high8.6CVSS 3.1

AVNACLPRNUINSCCHINAN

EXPLOIT

EPSS

8.15%

94.1th percentile

ShokoServer is a media server which specializes in organizing anime. In affected versions the `/api/Image/WithPath` endpoint is accessible without authentication and is supposed to return default server images. The endpoint accepts the parameter `serverImagePath`, which is not sanitized in any way before being passed to `System.IO.File.OpenRead`, which results in an arbitrary file read. This issue may lead to an arbitrary file read which is exacerbated in the windows installer which installs the ShokoServer as administrator. Any unauthenticated attacker may be able to access sensitive information and read files stored on the server. The `/api/Image/WithPath` endpoint has been removed in commit `6c57ba0f0` which will be included in subsequent releases. Users should limit access to the `/api/Image/WithPath` endpoint or manually patch their installations until a patched release is made. This issue was discovered by the GitHub Security lab and is also indexed as GHSL-2023-191.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
shokoanime	shokoserver	<= 4.2.2	—

Detection & IOCsextracted from sources · hover to see the quote

url/api/Image/WithPath↗

path/api/Image/withpath/C:\Windows\win.ini

otherserverImagePath↗

→A successful exploit response will return HTTP 200 with Content-Type: text/plain and body containing the strings 'bit app support', 'fonts', and 'extensions' (win.ini content), indicating arbitrary file read.
→Use FOFA query title="Shoko WEB UI" to identify exposed ShokoServer instances for proactive scanning.
→The fix removes the /api/Image/WithPath endpoint entirely in commit 6c57ba0f0; presence of this endpoint in a running instance indicates an unpatched installation. ↗

·Exploitation impact is significantly elevated on Windows installations because ShokoServer is installed and runs as Administrator, granting the file-read primitive access to all files on the system. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.