CVE-2023-46474 is a high severity (CVSS 7.2) unrestricted file upload flaw in the PMB library system, reached through start_import.php. A remote attacker with administrative access can execute code. The record names 7.4.8; a write-up says 7.5.3 and earlier are affected and 7.5.4 fixes it. Upgrade.
What's affected
The NVD record names PMB v.7.4.8. The researcher write-up we read says PMB 7.5.3 and earlier are affected and that 7.5.4 and later fix it, because the vulnerable import script was rewritten. This is a conflict in the version range, and the write-up range is wider.
Severity also differs. NVD scores it 7.2 High and the write-up scores it 9.1 Critical, noting high privileges are required and the scope changes. The write-up says an attacker needs administrative access. The weakness is CWE-434. We did not fetch an official PMB advisory, so confirm with the project.
The NVD record scores it 7.2 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The weakness class is CWE-434 (unrestricted file upload). The record does not list this CVE in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
Open the PMB administration area and read the version in the footer or about page. Anything at or below 7.5.3 should be treated as affected. Then check the directory where imported files are saved and look for files with script extensions that you did not create.
Also review the list of administrator accounts, since exploitation needs one.
What to do now
- Upgrade PMB to 7.5.4 or later.
- Review administrator accounts, remove stale ones and enforce strong unique passwords.
- Check upload and import directories for unexpected script files and remove any you find.
- Configure the web server so uploaded files cannot be executed.
- Restrict the administration interface to trusted networks.
Why it matters
Unrestricted file upload is a case where a feature meant to accept data files also accepts scripts, and the server then runs them. The write-up says the import script did not check extensions and kept the original one in a web accessible folder.
Because the attacker needs admin access first, this is often chained with weak or stolen credentials. The fix in the write-up rewrites the script, which is the right approach, since filtering extensions alone is fragile.
Quick check
Is the 7.4.8 in the record the full range?
The write-up says 7.5.3 and earlier, so assume more versions are affected.
Do you need to be an admin?
Yes, according to the record vector and the write-up.
Sources
Last reviewed: 19 October 2026.
