CVE-2023-50233 is a High severity (CVSS 8.8) directory traversal flaw in Inductive Automation Ignition. The getJavaExecutable method does not validate a user supplied path before using it in file operations, which can lead to code execution as the current user. Apply the vendor update.
What's affected
Product: Inductive Automation Ignition, with no version range in the record. ZDI published ZDI-24-185 on 21 February 2024, and NVD published the record on 3 May 2024.
I could not confirm a fixed version number from the pages I fetched. The ZDI advisory says Inductive Automation has issued an update, and points to the vendor security page, which loaded as a general trust center without a per-CVE version table. Treat the vendor advisory as the source of truth for the exact fixed release.
The vector is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, and ZDI says the target must connect to a malicious server. Like CVE-2023-50232, this is a client side exposure for the people running Ignition tools.
How to check if you're exposed
Ignition is installed as a gateway service, so the quickest check is the version shown on the gateway's own web page, plus the Designer and Vision Client versions on any workstation that connects to it. Write down every gateway, including test and edge gateways that people forget about.
Then compare each version with the fixed release named in the vendor's security advisory. If the advisory does not name a version for your release line, ask Inductive Automation support rather than guessing.
A dependency scanner will not see this one, because Ignition is a vendor product and not a package in your repository. Track it in your asset inventory instead, with its version and where it is reachable from.
What to do now
- Open the Inductive Automation security advisory linked below and find the fixed release for your Ignition line.
- Upgrade gateways, Designer installs and client launchers to that release, starting with systems that are reachable from less trusted networks.
- Record the new version in your asset inventory and remove old installers from shared drives so nobody reinstalls the vulnerable build.
- Where practical, restrict which servers workstations may reach, so a mistaken or tricked connection cannot go to an arbitrary host.
Why it matters
The weakness is CWE-22, path traversal. The program accepts a path from an outside source and uses it in file operations without confirming that the path stays inside the folder it should. Sequences that climb out of the intended directory then let the caller point the program at files it was never meant to touch.
The method named in the advisory, getJavaExecutable, is about locating a Java runtime. A path that resolves somewhere unintended means the program can end up running something other than the executable it expected. That is how a path problem becomes code execution, and the record rates the outcome as full confidentiality, integrity and availability impact.
No source I read says this CVE is exploited, and the KEV flag is false. Patching is cheap compared with the cost of cleaning up an engineering workstation. For the open source packages in your own code, run the free scan at gold.safeguard.sh/scan and read the Gold directory page for this CVE.
Quick check
What does path traversal mean here?
A path supplied from outside is used without being checked, so it can point outside the folder the program meant to use. That is the class named in the record, CWE-22.
Who is most at risk?
People who connect Ignition clients to servers they do not control. ZDI says user interaction is needed.
Sources
Last reviewed: 19 October 2026.
