---
id: 5212
title: "[CVE-2023-39631] Beyond the Bands: Exploiting TiTiler’s Expression Parser for Remote Code Execution"
cve: CVE-2023-39631
cvss: 9.8
severity: critical
source_domain: xbow.com
source_url: "https://xbow.com/blog/xbow-titiler-rce"
published_at: "2025-07-25T12:00:00Z"
tags: ["rce", "vulnerability-research", "python", "code-execution", "titiler", "expression-parser"]
phying_url: "https://phying.com/item/5212"
lang: en
---

# [CVE-2023-39631] Beyond the Bands: Exploiting TiTiler’s Expression Parser for Remote Code Execution

## Summary

A methodical study of TiTiler's expression parser that ends in arbitrary Python code execution on the server, with a bonus arbitrary file read saved for a follow-up post.

## Intelligence Metadata

- **Sources:** xbow.com
- **CVE:** CVE-2023-39631
- **CVSS:** 9.8
- **Published:** 2025-07-25T12:00:00Z
- **Original:** https://xbow.com/blog/xbow-titiler-rce
- **Phying News:** https://phying.com/item/5212