{"id":"CVE-2023-50255","summary":"Zip Path Traversal in Deepin-Compressor","details":"Deepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there's a path traversal vulnerability in deepin-compressor that can be exploited to achieve Remote Command Execution on the target system upon opening crafted archives. Users are advised to update to version 5.12.21 which addresses the issue. There are no known workarounds for this vulnerability.\n","aliases":["GHSA-rw5r-8p9h-3gp2"],"modified":"2026-08-12T14:51:45.154844Z","published":"2023-12-27T16:16:51.459Z","related":["openSUSE-SU-2023:0423-1","openSUSE-SU-2023:0424-1","openSUSE-SU-2024:13541-1"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-22","CWE-23","CWE-26"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50255.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50255.json"},{"type":"ADVISORY","url":"https://github.com/linuxdeepin/developer-center/security/advisories/GHSA-rw5r-8p9h-3gp2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-50255"},{"type":"FIX","url":"https://github.com/linuxdeepin/deepin-compressor/commit/82f668c78c133873f5094cfab6e4eabc0b70e4b6"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/linuxdeepin/deepin-compressor","events":[{"introduced":"0"},{"fixed":"3245d329090596f0304c7e3ec881ddacc5f42259"},{"fixed":"82f668c78c133873f5094cfab6e4eabc0b70e4b6"}],"database_specific":{"cpe":"cpe:2.3:a:deepin:deepin-compressor:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"5.12.21"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["5.12.20","5.12.19","5.12.18","5.12.17","5.12.15","5.12.14","5.12.13","5.12.12","5.12.11","5.12.10","5.12.9","5.12.8","5.12.7","5.10.4","5.10.3","5.10.2","5.10.0.22","5.10.1","5.10.0.21","5.10.0.20","5.10.0.19","5.10.0.18","5.10.0.17","5.10.0.16","5.10.0.15","5.10.0.14","5.10.0.13","5.10.0.12","5.10.0.11","5.10.0.10","5.10.0.9","5.10.0.8","5.10.0.7","5.10.0.6","5.10.0.5","5.10.0.3","5.10.0.2","5.9.0.5","5.9.0.4","5.9.0.3","5.9.0.2","5.9.0.1","5.8.0.25","5.8.0.24","5.8.0.23","5.8.0.22","5.8.0.19","5.8.0.18","5.8.0.16","5.8.0.15","5.8.0.13","5.8.0.11","5.8.0.10","5.8.0.9","5.6.2","5.8.0.3","5.8.0.2","5.8.0.1","5.6.16","5.6.15","5.6.14","5.6.13","5.6.12","5.6.11","5.6.10","5.6.9","5.6.8","5.6.7","5.6.6","5.6.5","5.6.4","5.6.3","5.6.1.2","5.6.1.1","5.6.1","5.6.0","5.5.9","5.5.8","5.5.6","5.5.5","5.5.4","5.5.3","5.5.2","5.5.1","5.5.0","5.4.9","5.4.8","5.4.7","5.4.6","5.4.5","5.4.4","5.4.3","5.4.2","5.4.1","5.4.0","5.3.9","5.3.8","5.3.7","5.3.6","5.3.5","5.3.4","5.3.3","5.3.2","5.3.1","5.3.0","5.2.9","5.2.8","5.2.7","5.2.6","5.2.5","5.2.4","5.2.3","5.2.2","5.2.1","5.2.0","5.1.3","5.1.2","5.1.1","5.1.0","5.0.9","5.0.8","5.0.7","5.0.6","5.0.5","5.0.4","5.0.3","0.0.1.1","0.0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-50255.json","vanir_signatures_modified":"2026-08-12T14:51:45Z","vanir_signatures":[{"target":{"file":"3rdparty/libzipplugin/libzipplugin.cpp","function":"LibzipPlugin::extractEntry"},"deprecated":false,"digest":{"length":7205,"function_hash":"30247516533539987400784967614032664171"},"id":"CVE-2023-50255-eb3847d1","signature_type":"Function","signature_version":"v1","source":"https://github.com/linuxdeepin/deepin-compressor/commit/82f668c78c133873f5094cfab6e4eabc0b70e4b6"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/linuxdeepin/deepin-compressor/commit/82f668c78c133873f5094cfab6e4eabc0b70e4b6","target":{"file":"3rdparty/libzipplugin/libzipplugin.cpp"},"deprecated":false,"digest":{"line_hashes":["29277564707855271562892623171227298326","82139166949263009477245266924836789791","319882807731388853601838031301874728851","270338458632400129569113518676444653160"],"threshold":0.9},"id":"CVE-2023-50255-ec40ca7c"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N"}]}