CVE-2023-6078 is a high severity (CVSS 8.8) OS command injection flaw in BIOVIA Materials Studio, releases BIOVIA 2021 through BIOVIA 2023. Uploading a specially crafted Perl script can lead to arbitrary command execution. The record names no fixed release, so read the Dassault Systemes advisory for your version.
What's affected
- Product: BIOVIA Materials Studio, from release BIOVIA 2021 through release BIOVIA 2023.
- Fixed version: not stated in the NVD record. The Dassault Systemes advisories page the record links is an index, and it did not show a fixed build in this review. Check it for the entry that covers this CVE.
- Severity: 8.8 High in the NVD record.
- Weakness: OS command injection through an uploaded script file.
- Detail limit: the record is short, and this post does not guess beyond it.
How to check if you're exposed
Open Materials Studio and read the release name from the About dialog, then check whether it is in the 2021 through 2023 range. In a shared installation, find out whether the server component that accepts uploaded scripts is exposed to more users than the desktop client.
Ask who can upload scripts to your installation, and from where. The record says the flaw depends on uploading a crafted Perl script, so access control around that feature is the key question.
What to do now
- Open the Dassault Systemes security advisories page and find the entry for CVE-2023-6078, then apply the fixed release or patch it names.
- Restrict who can upload scripts to Materials Studio to the smallest group that needs it.
- Run the application server with the least privilege it needs, and keep it off the internet.
- Review recent uploaded scripts for anything you do not recognize.
- Record your Materials Studio release and update date in your software inventory.
Why it matters
The record says an uploaded Perl script can lead to arbitrary command execution. This is CWE-78, improper neutralization of special elements used in an OS command. In practice, an application that accepts and runs scripts needs to either strictly limit what they can do or restrict who may supply them. When neither is true, upload becomes code execution on the server.
Research software often runs on shared servers and handles valuable data, such as molecular models and proprietary results. A weakness in a scientific tool still matters because the host may sit inside a trusted lab or corporate network. The score of 8.8 reflects network access with low privileges. The record does not list this CVE as known exploited. The shortage of public detail is a reason to follow the vendor, not a reason to wait.
Quick check
Is there a confirmed fixed version?
Not from the sources checked. The NVD record gives no fix, and the vendor page is a general index. Use Dassault Systemes support for the exact release.
Sources
Last reviewed: 19 October 2026.
