affected:
- package:
    ecosystem: PyPI
    name: repox
    purl: pkg:pypi/repox
  ranges:
  - events:
    - introduced: '0'
    type: ECOSYSTEM
  versions:
  - 0.0.1
  - 0.0.2
  - 0.0.3
aliases:
- CVE-2023-6721
details: An XEE vulnerability has been found in Repox, which allows a remote attacker
  to interfere with the application's XML data processing in the fileupload function,
  resulting in interaction between the attacker and the server's file system.
id: PYSEC-2023-296
modified: '2024-11-21T14:23:00.841929Z'
published: '2023-12-13T10:15:00Z'
references:
- type: WEB
  url: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-repox
severity:
- score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
  type: CVSS_V3
withdrawn: '2024-11-22T04:37:05Z'