NetSight
IP …
medium5.5

CVE-2023-38633

A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem…

Impact

A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by href=".?../../../../../../../../../../etc/passwd" in an xi:include element.

Affected products

VendorProductAffected versions
GnomeLibrsvg
from 2.42.3 before 2.46.6
from 2.48.0 before 2.48.11
from 2.50.0 before 2.50.8
from 2.52.0 before 2.52.10
from 2.54.0 before 2.54.6
from 2.55.0 before 2.55.3
FedoraprojectFedora
Versions 37, 38
DebianDebian Linux
Versions 11.0, 12.0

Weakness classification

CWE-22

References