Xibo is a content management system (CMS). Starting in version 3.0.0 and prior to version 3.3.5, some API routes will print a stack trace when called with missing or invalid parameters revealing sensitive information about the locations of paths that the server is using. Users should upgrade to version 3.3.5, which fixes this issue. There are no known workarounds aside from upgrading.
Fix
Patch, vendor advisory and mitigation references on NVD 4
- https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-c9cx-ghwr-x58m Vendor Advisory
- https://xibosignage.com/blog/security-advisory-2023-05/ Vendor Advisory
- https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-c9cx-ghwr-x58m Vendor Advisory
- https://xibosignage.com/blog/security-advisory-2023-05/ Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 5.3 · xibosignageNVD modified 2026-10-28 19:10
Affected (CPE criteria) 1
cpe:2.3:a:xibosignage:xibo:*:*:*:*:*:*:*:*
References 6
- https://claroty.com/team82/disclosure-dashboard Issue Tracking, Third Party Advisory
- https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-c9cx-ghwr-x58m Vendor Advisory
- https://xibosignage.com/blog/security-advisory-2023-05/ Vendor Advisory
- https://claroty.com/team82/disclosure-dashboard Issue Tracking, Third Party Advisory
- https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-c9cx-ghwr-x58m Vendor Advisory
- https://xibosignage.com/blog/security-advisory-2023-05/ Vendor Advisory