What’s Vulnerable › Vulnerabilities

CVE-2023-38633

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-07-22 · updated 2026-06-17
• Weakness: CWE-22

Description

A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by href=".?../../../../../../../../../../etc/passwd" in an xi:include element.

Affected products

• Debian Linux: 11.0, 12.0
• Fedoraproject Fedora: 37, 38
• GNOME Librsvg: from 2.42.3 before 2.46.6; from 2.48.0 before 2.48.11; from 2.50.0 before 2.50.8; from 2.52.0 before 2.52.10; from 2.54.0 before 2.54.6; from 2.55.0 before 2.55.3 — fixed in 2.46.6, 2.48.11, 2.50.8, 2.52.10, 2.54.6, 2.55.3

How to fix

Upgrade to a fixed version: GNOME Librsvg 2.46.6, 2.48.11, 2.50.8, 2.52.10. Check the vendor advisory for mitigations.

References

• http://seclists.org/fulldisclosure/2023/Jul/43
• http://www.openwall.com/lists/oss-security/2023/07/27/1
• http://www.openwall.com/lists/oss-security/2023/09/06/10
• https://bugzilla.suse.com/show_bug.cgi?id=1213502
• https://gitlab.gnome.org/GNOME/librsvg/-/issues/996
• https://gitlab.gnome.org/GNOME/librsvg/-/releases/2.56.3
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/422NTIHIEBRASIG2DWXYBH4ADYMHY626/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R5BCXT5GW6RCL45ZUHUZR4CJG2BAFDVC/
• https://news.ycombinator.com/item?id=37415799
• https://security.netapp.com/advisory/ntap-20230831-0011/
• https://www.canva.dev/blog/engineering/when-url-parsers-disagree-cve-2023-38633/
• https://www.debian.org/security/2023/dsa-5484

Get alerted when CVE-2023-38633 or the next vulnerability affects your stack