CVE-2023-40051 is a Critical severity (CVSS 9.1) arbitrary file upload flaw in the WEB transport of Progress Application Server (PAS) for OpenEdge. The record lists fixes in 11.7.18, 12.2.13 and innovation release 12.8.0. Upgrade to those releases or later and review who can reach PASOE.
What's affected
Affected, per the NVD record: Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation releases prior to 12.8.0. Fixed: 11.7.18, 12.2.13 and 12.8.0 or later.
I could not load Progress's own advisory page when preparing this post (it returned a page error instead of content), so these versions come from the NVD record. Confirm them against the Progress community advisory linked below before you plan a rollout.
How to check if you're exposed
Identify the OpenEdge release on each host that runs PASOE. The release is recorded in the version file under the OpenEdge install directory (the DLC directory), and your installer or change records should also show it. Then compare:
- 11.7 installs: below 11.7.18 is affected.
- 12.2 installs: below 12.2.13 is affected.
- Innovation releases: below 12.8.0 is affected.
Next, list which PASOE instances expose the WEB transport and which networks can reach them. Internet facing instances come first.
What to do now
- Inventory all OpenEdge hosts running PASOE and record their release.
- Upgrade to 11.7.18, 12.2.13 or 12.8.0 or later, depending on your release line, after confirming against the Progress advisory.
- Limit network reach to the WEB transport to trusted clients and put a gateway or WAF in front of exposed instances.
- Review upload directories and server logs for files or requests you do not recognize.
- Monitor PASOE agents for unexpected crashes or restarts.
Why it matters
The weakness class is CWE-434 (unrestricted upload of dangerous file type). An attacker can formulate a request for the WEB transport that allows unintended file uploads to a server directory path on the system running PASOE. If the upload contains a payload that can further exploit the server or its network, a larger scale attack may be possible.
The record scores this Critical at CVSS 9.1. NVD published it on 2024-01-18. The KEV flag is false and I did not find a claim of exploitation in the sources available to me. Application servers that accept uploads from the network deserve prompt patching even without exploitation reports, because the step from an unintended file landing on a server to code running there is often short.
Safeguard offers a free in-browser dependency scan at gold.safeguard.sh/scan for projects that pull in packages, and the Gold directory lists this CVE alongside its CWE and related records. Reachability analysis helps you rank findings by whether the vulnerable code is actually used, which matters when a long list of advisories lands at once.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Where do the fixed versions come from?
From the NVD record. Progress's advisory page did not load for this review, so confirm the numbers with Progress.
Is this exploited in the wild?
The KEV flag is false and no source I could read says so.
Sources
- Progress OpenEdge advisory (page did not load, versions taken from the NVD record)
Last reviewed: 19 October 2026.
