CVE-2023-34854: HotelDruid Path Traversal Vulnerability

CVE-2023-34854 Overview

CVE-2023-34854 affects HotelDruid, an open-source hotel management application, in versions prior to 3.0.6. The vulnerability stems from insufficient file upload sanitation in the backup and restore function. An authenticated attacker with high privileges can upload files that bypass validation checks, leading to compromise of confidentiality, integrity, and availability of the host system. The flaw is classified under [CWE-434] Unrestricted Upload of File with Dangerous Type.

Critical Impact
An authenticated administrative user can abuse the backup/restore endpoint to upload arbitrary files, potentially resulting in remote code execution on the HotelDruid server.

Affected Products

HotelDruid versions before 3.0.6
HotelDruid backup/restore functionality
Debian packages tracking HotelDruid (per Debian Security Tracker)

Discovery Timeline

2026-09-14 - CVE-2023-34854 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2023-34854

Vulnerability Analysis

HotelDruid provides a backup and restore feature to administrators for archiving and recovering application data. The restore workflow accepts uploaded archive files but fails to enforce sufficient validation on the file type, extension, or content before writing the payload to disk within a web-accessible directory. Because the resulting file can be interpreted by the underlying PHP runtime, an attacker who reaches this workflow gains a path to code execution on the server.

The attack requires network access to the HotelDruid interface and authenticated access with high privileges. Successful exploitation impacts confidentiality, integrity, and availability of both the application and hosted data.

Root Cause

The root cause is missing or incomplete validation on files handled by the backup/restore function. HotelDruid does not adequately restrict acceptable file types, sanitize filenames, or verify archive contents. This maps directly to [CWE-434] Unrestricted Upload of File with Dangerous Type, where server-side controls fail to block executable content.

Attack Vector

An authenticated administrator, or an attacker who has obtained administrative credentials through phishing, credential reuse, or session compromise, navigates to the backup restore functionality. The attacker submits a crafted archive or file that survives the weak validation logic. Once written to a web-accessible path, the file can be requested through the web server, causing the PHP interpreter to execute attacker-controlled code under the web server account.

No verified public proof-of-concept code is available. For technical tracking details, see the Debian Security Tracker CVE-2023-34854 entry.

Detection Methods for CVE-2023-34854

Indicators of Compromise

Unexpected files with executable extensions such as .php, .phtml, or .phar appearing in HotelDruid upload, backup, or restore directories.
Web server access logs showing POST requests to backup or restore endpoints from unusual source IPs or outside maintenance windows.
New administrator sessions originating from geographies inconsistent with staff activity, followed by activity against the restore function.
Outbound network connections initiated by the PHP process to unknown hosts after a restore action.

Detection Strategies

Monitor the HotelDruid application directory for file creation events using file integrity monitoring, alerting on any script file placed by the web server user.
Correlate web access logs against authentication logs to identify restore invocations that do not match legitimate administrator workflows.
Inspect uploaded archives for embedded server-side script content before extraction using antivirus or YARA rules targeting webshell signatures.

Monitoring Recommendations

Enable verbose logging on the HotelDruid administrative interface and forward logs to a central SIEM.
Alert on process execution chains where the web server spawns shells such as sh, bash, or cmd.exe.
Baseline normal backup and restore frequency, and alert on deviations from that baseline.

How to Mitigate CVE-2023-34854

Immediate Actions Required

Upgrade HotelDruid to version 3.0.6 or later, which addresses the file upload sanitation gap in the backup/restore function.
Rotate all administrator credentials and invalidate active sessions after patching.
Audit HotelDruid installation directories for unauthorized files and remove any suspected webshells.
Restrict access to the HotelDruid administrative interface using network-level controls or a VPN.

Patch Information

Apply the upstream fix by upgrading HotelDruid to version 3.0.6 or later. Debian and downstream distributions track packaged updates through the Debian Security Tracker CVE-2023-34854 advisory. Verify the installed version after upgrade and confirm that the backup/restore workflow rejects non-archive file types.

Workarounds

Disable the backup/restore feature until the upgrade is applied, if operationally feasible.
Enforce strong, unique passwords and multi-factor authentication for all HotelDruid administrator accounts to reduce the likelihood of reaching the vulnerable code path.
Configure the web server to disallow execution of PHP files inside upload and backup directories.

bash

# Example Apache configuration to block script execution in upload directories
<Directory "/var/www/hoteldruid/backup">
    php_admin_flag engine off
    <FilesMatch "\.(php|phtml|phar)$">
        Require all denied
    </FilesMatch>
</Directory>