Mastodon fixes major security flaw that could have allowed system hijacking

Social media challenger Mastodon has issued a fix for new fewer than five security vulnerabilities, the majority of which categorized as high or critical severity.

The flaws include CVE-2023-36460, which could have allowed an attacker to create and overwrite any file Mastodon has access to, allowing Denial of Service and arbitrary Remote Code Execution. The update confirms that versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this vulnerability.