ZKBio Time - Path Traversal (CVE-2023-38950)

CVE-2023-38950 is a path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 which allows unauthenticated attackers to read arbitrary files on the server by sending specially crafted requests. This security flaw could be exploited to access sensitive information, configuration files, or credentials, potentially leading to further attacks on the affected system.

CrowdSec has been tracking this vulnerability and its exploits since 25th of June 2025.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2023-38950 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2023-38950 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2023-38950 is currently experiencing high visibility and active exploitation across the internet.

Attackers exploit the /iclock/file endpoint by supplying directory traversal sequences in the url parameter to access arbitrary files on the server.