---
id: CVE-2023-34968
title: 'Samba: spotlight server-side share path disclosure'
summary: >-
  A path disclosure vulnerability was found in Samba. As part of the Spotlight
  protocol, Samba discloses the server-side absolute path of shares, files, and
  directories in the results for search queries. This flaw allows a malicious
  client…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-201
vendor: Red Hat
product: samba
affected:
  - samba (all versions)
  - samba (all versions)
  - samba (all versions)
  - samba (all versions)
  - samba (all versions)
  - samba (all versions)
  - samba (all versions)
  - samba
  - samba4
  - samba
  - samba
published: '2023-07-20'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T20:25:14.422Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-34968'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2023:6667'
    label: 'RHSA-2023:6667'
  - url: 'https://access.redhat.com/errata/RHSA-2023:7139'
    label: 'RHSA-2023:7139'
  - url: 'https://access.redhat.com/errata/RHSA-2024:0423'
    label: 'RHSA-2024:0423'
  - url: 'https://access.redhat.com/errata/RHSA-2024:0580'
    label: 'RHSA-2024:0580'
  - url: 'https://access.redhat.com/security/cve/CVE-2023-34968'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2222795'
    label: RHBZ#2222795
  - url: 'https://www.samba.org/samba/security/CVE-2023-34968.html'
tags:
  - cve.org
epss: 0.01333
epssPercentile: 0.71311
ingestedAt: '2026-11-06T21:04:04.249Z'
---

## Overview

A path disclosure vulnerability was found in Samba. As part of the Spotlight protocol, Samba discloses the server-side absolute path of shares, files, and directories in the results for search queries. This flaw allows a malicious client or an attacker with a targeted RPC request to view the information that is part of the disclosed path.

## Affected

- `samba (all versions)`
- `samba (all versions)`
- `samba (all versions)`
- `samba (all versions)`
- `samba (all versions)`
- `samba (all versions)`
- `samba (all versions)`
- `samba`
- `samba4`
- `samba`
- `samba`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.