CVE-2023-48710 is a critical (CVSS 9.8) flaw in Combodo iTop where files in the env-production folder can be retrieved through the pages/exec.php script. It is fixed in iTop 2.7.10, 3.0.4, 3.1.1 and 3.2.0. Upgrade, and check whether any third-party module stores sensitive files there.
What's affected
- iTop 2.7.9, 3.0.3 and 3.1.0 are listed as affected in GitHub advisory GHSA-g652-q7cc-7hfc.
- Patched versions: 2.7.10, 3.0.4, 3.1.1 and 3.2.0. Note that 2.7.10 is the fix on the 2.7 branch, one release later than the fix for the formula injection issue CVE-2023-48709.
- The advisory says there is no workaround. Any file inside the env-production folder can be retrieved until you patch.
- Combodo notes that iTop itself does not store sensitive files in that folder natively, but a third-party module could.
- Severity: the record gives CVSS 9.8, which is critical. KEV status: the record shows kev as false, and none of the sources we read report exploitation in the wild.
The CVSS 3.1 vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Read plainly, it describes an attack over the network, with low attack complexity, requiring no privileges and no user interaction. Impact on confidentiality is high, on integrity high and on availability high. The scope is unchanged, so the impact stays within the vulnerable component.
How to check if you're exposed
Find your iTop version in the application footer or About page. If it is below the patched number for your branch, you are in range.
Then look at what is actually sitting in the env-production folder of your installation. List the folder and read the file names, not the contents of anything secret, and ask which module wrote each file. Anything that was never meant to be public, such as exports, logs, backups or configuration written by an extension, is the real exposure.
ls -la /path/to/itop/env-production
Replace the path with your install location. Treat the output as an inventory exercise.
What to do now
- Upgrade iTop to 2.7.10, 3.0.4, 3.1.1 or 3.2.0 depending on your branch.
- Review every third-party iTop extension you run and note where it writes files.
- Move any sensitive output out of the env-production folder, or stop the module from writing it.
- Rotate any credential or token you find stored in files under that folder.
- Add the iTop host to your external exposure review, since the issue needs no login.
Why it matters
The class is CWE-552 (Files or Directories Accessible to External Parties). The exec.php script was meant to serve PHP files, but it would also serve other file types from that folder. The patch limits it to PHP files only.
The 9.8 score reflects the worst case: network reachable, no login, high impact. Combodo points out that the native product keeps nothing sensitive there, so your real exposure depends on what you have added. That is a useful reminder that a vulnerability score describes the component, while your risk depends on what your own deployment puts in it.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a workaround if I cannot upgrade today?
The advisory says there is none. Limit network access to the iTop host and clean the folder of sensitive files while you plan the upgrade.
Does a default iTop install leak secrets here?
Combodo says no sensitive files are stored there natively. Third-party modules are the concern.
Sources
Last reviewed: 19 October 2026.
