CVE-2023-50090 is a critical (CVSS 9.8) arbitrary file write flaw in the saveReportFile method of ureport2, a Java report designer, in versions 2.2.9 and earlier. The record says a crafted POST request can write files and run commands. We could not confirm a fixed version, so check the project and limit exposure now.
What's affected
- ureport2 2.2.9 and before, as stated in the NVD description. The record's product entry lists the ureport2 project with no lower or upper version bounds.
- Fixed version: not confirmed. The GitHub Advisory Database entry we read is marked unreviewed and shows both affected and patched versions as unknown. Check the ureport2 repository and its release notes before relying on any upgrade.
- Attack conditions in the record: network reachable, low complexity, no privileges and no user interaction (CVSS vector AV:N/AC:L/PR:N/UI:N).
- KEV status: the record shows kev as false, and neither source we read says the flaw is exploited in the wild.
How to check if you're exposed
ureport2 is normally embedded in a Java web application rather than run on its own, so the first job is finding where it sits in your builds. From a project root, these commands list it if it is a direct or transitive dependency.
mvn dependency:tree | grep -i ureport
./gradlew dependencies | grep -i ureport
Then check the version against the 2.2.9 boundary. Also check whether the report designer or its save endpoint is reachable from outside your network. You can paste a manifest into the free in-browser dependency scan at gold.safeguard.sh/scan to see whether the package is present.
What to do now
- Find every application that bundles ureport2 and record the version.
- Remove the report designer endpoints from public reach. Put them behind a VPN or an authenticated reverse proxy until you have a fix.
- Watch the project repository and the GitHub advisory entry for a patched release, and upgrade as soon as one is published.
- If a patched version is not available, consider replacing the component or disabling the report save feature in your deployment.
- Review the file system of any exposed host for files you did not put there, and rotate secrets stored on that host if you find any.
Why it matters
The weakness is an unrestricted file write. When a server accepts a file name and content from a request and saves it without limiting where it can go or what it can contain, an attacker can place a file in a location the application later executes. That is how a write primitive becomes command execution. The description in the record says exactly that outcome is possible here.
The record does not assign a CWE identifier, and the only public write-up referenced is a third-party blog post, so the exact cause inside saveReportFile is not something we can describe further. What is clear is the exposure pattern: an unauthenticated, network reachable endpoint with write access to the server. Treat any internet facing ureport2 instance as high priority.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a patched version of ureport2?
We could not confirm one. The advisory entry we read lists patched versions as unknown, so check the project repository and release notes directly.
Is CVE-2023-50090 on the CISA KEV list?
No. The record shows kev as false, and we did not find a source reporting exploitation in the wild.
Sources
- NVD record for CVE-2023-50090
- GitHub Advisory Database entry GHSA-445x-c8qq-qfr9
Last reviewed: 19 October 2026.
