CVE-2023-0592: Path traversal in jefferson

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-01-31 · updated 2026-06-17
Weakness: CWE-22

Description

A path traversal vulnerability affects jefferson's JFFS2 filesystem extractor. By crafting malicious JFFS2 files, attackers could force jefferson to write outside of the extraction directory.This issue affects jefferson: before 0.4.1.

Affected products

sviehb jefferson: before 0.4.1 — fixed in 0.4.1

How to fix

Upgrade to a fixed version: sviehb jefferson 0.4.1. Check the vendor advisory for mitigations.

References

https://github.com/sviehb/jefferson/commit/971aca1a8b3b9f4fcb4674fa9621d3349195cdc6
https://onekey.com/blog/security-advisory-remote-command-execution-in-binwalk/
https://github.com/sviehb/jefferson/commit/971aca1a8b3b9f4fcb4674fa9621d3349195cdc6
https://onekey.com/blog/security-advisory-remote-command-execution-in-binwalk/

Get alerted when CVE-2023-0592 or the next vulnerability affects your stack