CVE-2023-45723 is a high severity path traversal flaw in the file upload feature of HCL DRYiCE MyXalytics, scored 7.6. Users can control where uploaded files are stored. Versions 5.9, 6.0 and 6.1 are listed. Apply the fix in HCL bulletin KB0109608.
What's affected
The NVD record lists HCL DRYiCE MyXalytics versions 5.9, 6.0 and 6.1 as affected. HCL's security bulletin, KB0109608, is the vendor source for fixes, but its content is loaded dynamically and I could not read the fix details from it. I will not guess a fixed version, so open the bulletin to confirm what HCL says to install.
Three CVEs in this range come from the same bulletin: CVE-2023-45722 (path traversal file read), CVE-2023-45723 (path traversal in file upload) and CVE-2023-45724 (unauthenticated file upload). The record dates are 3 January 2024.
How to check if you're exposed
In the MyXalytics administration pages or install directory, find the product version and compare it with 5.9, 6.0 and 6.1. Your HCL support contact or installation record also holds this.
Then check whether the application is reachable beyond the networks that need it. These flaws are in the web application, so exposure follows from who can reach its HTTP port. Review reverse proxy and firewall rules, and look in web server logs for requests to the affected endpoints with unusual paths.
What to do now
- Confirm the MyXalytics version against 5.9, 6.0 and 6.1.
- Apply the remedy in HCL bulletin KB0109608.
- Limit who can reach the upload endpoints, ideally to a VPN or internal range.
- Look for unexpected files in the application directories and web root.
- Run the application with the lowest file system rights it needs.
Why it matters
The weakness is path traversal, CWE-22, here on the write side. The record says certain endpoints let users manipulate the path, including the file name, where uploads are stored. An attacker who controls the destination can place or overwrite files in locations the application did not intend.
The vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L. Writes into the wrong directory matter most when that directory is served by the web server or loaded by the application, because a planted file can then be run.
The CVE is not on the CISA KEV list. A good habit for any upload feature is to generate the stored name on the server and ignore the client supplied path.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan reads the manifests and lockfiles of software projects. It will not see firmware or device images, so for this issue the asset inventory and the vendor advisory are your main tools.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
How is this different from CVE-2023-45722?
This one is about where uploaded files are written. The other is about reading files outside the intended directory.
Is a fix version confirmed?
Not by anything I could read. HCL's bulletin KB0109608 has the details.
Sources
- HCL security bulletin KB0109608 (content loads dynamically, so confirm fix details there)
- NVD record data for CVE-2023-45723
Last reviewed: 19 October 2026.
