CVE-2023-50982 is a critical severity (CVSS 9.0) flaw in Stud.IP 5.x through 5.3.3. The smiley admin upload does not check file extensions, which leads to cross-site scripting and code execution as the web user. The fixed versions are 5.3.4, 5.2.6, 5.1.7 and 5.0.9.
What's affected
The NVD description says Stud.IP 5.x through 5.3.3 is affected. The upload_action and edit_action methods in Admin_SmileysController do not check the file extension, which allows XSS with resultant upload of executable files. The result is remote code execution with the privileges of the www-data user.
The description names four fixed versions, one per supported branch: 5.3.4, 5.2.6, 5.1.7 and 5.0.9. I could not load the researcher's write-up when preparing this guide, so these versions come from the NVD text. Confirm them against the Stud.IP release tags (listed in the NVD record) and the project's download page.
CVSS for this entry is 9.0 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H.
How to check if you're exposed
Open the Stud.IP admin area or the version file on the server to find your release. Match it to a branch: 5.0, 5.1, 5.2 or 5.3. If your version is below the fixed release for that branch, you are exposed. Releases older than 5.0 are not covered by the record, so check with the project about their status.
Also review the smiley directory on the server for files that should not be there, such as scripts, and look at web server logs for unexpected requests to the smiley admin pages.
What to do now
- Identify your Stud.IP branch and exact version.
- Upgrade to the fixed version for your branch: 5.3.4, 5.2.6, 5.1.7 or 5.0.9, or a later release.
- Check the smiley upload directory for unexpected non-image files and remove anything you cannot account for.
- Restrict who holds Stud.IP administrator accounts, and make sure the web server does not execute scripts from upload directories.
- Review access logs for the smiley admin endpoints from before the upgrade.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan against your manifests, and look the entry up in the Safeguard Gold directory to see how it is tracked.
Why it matters
CWE-79 is cross-site scripting. The application places attacker-influenced content into a page without neutralizing it, so a victim's browser runs script in the context of the trusted site. The fix is to encode output for the context it lands in and to validate input where it enters.
CWE-434 is unrestricted upload of a file of a dangerous type. If an application accepts a file without checking its type, an attacker may be able to place content the server will later execute. The fix is to allow only expected extensions and types, and to store uploads where they cannot be run.
Two weaknesses combine here. CWE-79 lets script run in an administrator's session, and CWE-434 means the upload does not restrict what type of file it accepts. The vector shows a low privilege requirement with user interaction, and a changed scope, which is why the score reaches 9.0.
The lesson is general: upload handlers should allow only the extensions they expect, and the directory they write to should never be executable.
The record does not mark this CVE as listed in the CISA Known Exploited Vulnerabilities catalog, and no source I read reports exploitation in the wild.
Quick check
Is there only one fixed version?
No. The NVD text lists a fixed release for each of four branches. Pick the one that matches your branch.
Does the record say it is exploited?
No. The KEV flag is false and the text reports no exploitation.
Sources
- Stud.IP release tags (listed in the NVD record)
- Researcher write-up listed in the NVD record (page did not load for me)
- Stud.IP downloads (listed in the NVD record)
Last reviewed: 19 October 2026.
