CVE Catalog
CVE-2023-38633
MediumCVSS 5.5Exploitation Probability (EPSS)
High risk2.13%
80th percentile - higher than 80% of all known CVEs
Summary
A directory traversal issue in the URL decoder of librsvg before version 2.56.3 could be exploited by local or remote attackers to disclose files from the local filesystem outside of the expected area.
Risk Assessment
Attackers may gain access to sensitive system files, potentially leading to data disclosure and security breaches.
Recommendation
It is recommended to update librsvg to version 2.56.3 or later to mitigate this vulnerability.
Original NVD description (English source)
A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by href=".?../../../../../../../../../../etc/passwd" in an xi:include element.