CVE-2013-6234: Unrestricted file upload vulnerability in the Worksheet designer in SpagoBI before 4.1 allows remote authen...

Security readout for executives and security teams

CVE-2013-6234 affects SpagoBI before 4.1. An authenticated remote user could upload a file with an executable extension through the Worksheet designer and later access it directly, potentially causing arbitrary code execution. Business urgency depends on whether legacy SpagoBI is still deployed and reachable by users. Exposure is likely limited to organizations still running SpagoBI before 4.1 with the Worksheet designer available to authenticated users. Internet-facing BI portals, shared analyst environments, or weakly governed user access would increase practical risk. Prioritize this if legacy SpagoBI remains in production or exposed to broad authenticated access. The key risk is server-side code execution from a web application feature, but evidence is incomplete on current exploitation and exact affected configurations. Mitigation focus: Inventory SpagoBI deployments and identify any version before 4.1.; Check vendor guidance and upgrade away from affected versions where applicable.; Restrict Worksheet designer access to trusted authenticated users only..

Prepared

Jun 6, 2026, 04:48 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.