Medium 5.3Published May 30, 2023

CVE-2023-33181Xibo is a content management system (CMS).

Updated under an hour ago (Oct 30, 2026, 4:50 AM ET)

Does this affect you?

It affects xibosignage xibo. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stackFree account, 3 products Every CVE for xibosignage xibo Exploited in the last 30 days

Xibo is a content management system (CMS). Starting in version 3.0.0 and prior to version 3.3.5, some API routes will print a stack trace when called with missing or invalid parameters revealing sensitive information about the locations of paths that the server is using. Users should upgrade to version 3.3.5, which fixes this issue. There are no known workarounds aside from upgrading.

CVSS: 5.3 MEDIUM (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness (CWE): CWE-209
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Not given
NVD analysis: Modified
Record last updated: Oct 28, 2026
First seen by InfoSec Signals: Oct 28, 2026

Affected products

Affected products

xibosignage xibo xibosignage:xibo	from 3.0.0 before 3.3.5	NVD

References

References

https://claroty.com/team82/disclosure-dashboard	issue-tracking, third-party-advisory
https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-c9cx-ghwr-x58m	vendor-advisory
https://xibosignage.com/blog/security-advisory-2023-05/	vendor-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.