CVE-2023-52138

mate-desktop engrampa

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2023-52138

Katalog CVE

CVSS 9.6 · Critical EPSS 1,7%

Kerentanan Path Traversal: '/../filedir' pada mate-desktop engrampa. Skor CVSS 3.1 9.6 (Critical) menurut NVD.

Deskripsi (NVD)

Engrampa is an archive manager for the MATE environment. Engrampa is found to be vulnerable to a Path Traversal vulnerability that can be leveraged to achieve full Remote Command Execution (RCE) on the target. While handling CPIO archives, the Engrampa Archive manager follows symlink, cpio by default will follow stored symlinks while extracting and the Archiver will not check the symlink location, which leads to arbitrary file writes to unintended locations. When the victim extracts the archive, the attacker can craft a malicious cpio or ISO archive to achieve RCE on the target system. This vulnerability was fixed in commit 63d5dfa.

Rincian

Terbit di NVD
5 Februari 2024
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
9.6 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-25: Path Traversal: '/../filedir'
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-59: Improper Link Resolution Before File Access ('Link Following')
EPSS (30 hari)
1,7% peluang dieksploitasi; lebih tinggi dari 76,1% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
mate-desktop engrampa Semua versi sebelum 1.26.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.