CVE-2023-50255

Zip Path Traversal in Deepin-Compressor

Deepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there's a path traversal vulnerability in deepin-compressor that can be exploited to achieve Remote Command Execution on the target system upon opening crafted archives. Users are advised to update to version 5.12.21 which addresses the issue. There are no known workarounds for this vulnerability.

Affected

linuxdeepin · developer-center

CVSS v3.1 NVD

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v3.1 GITHUB

9.3 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

EPSS

1.05% chance of exploitation in the next 30 days, 64th percentile

Published

2023-12-27

Updated

2024-08-02

Proof-of-concept exploits (1)

• linuxdeepin/developer-center/security/advisories/GHSA-rw5r-8p9h-3gp2

Security advisories

• linuxdeepin/deepin-compressor/commit/82f668c78c133873f5094cfab6e4eabc0b70e4b6

References

• CVE Record
• NVD entry