CVE-2023-0591 json
Path Traversal in ubi_reader
published 2023-01-31 3 y ago modified 2026-06-17 4 mo ago also GHSA-vp2x-3mc3-3cj4 , PYSEC-2023-51 , EUVD-2023-0251
- cvss
- 5.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 33%
- public exploits
- 0
- none known
Summary
ubireader_extract_files is vulnerable to path traversal when run against specifically crafted UBIFS files, allowing the attacker to overwrite files outside of the extraction directory (provided the process has write access to that file or directory).
This is due to the fact that a node name (dent_node.name) is considered trusted and joined to the extraction directory path during processing, then the node content is written to that joined path. By crafting a malicious UBIFS file with node names holding path traversal payloads (e.g. ../../tmp/outside.txt), it's possible to force ubi_reader to write outside of the extraction directory.
This issue affects ubi-reader before 0.8.5.
Patch / fix
- pypi ubi-reader 0.8.5
- jrspruitt ubi_reader 0.8.5
- github.com/jrspruitt/ubi_reader@d5d68e6 commit
- github.com/jrspruitt/ubi_reader#57 pull request
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 19 mo ago
Exploit prediction
0.39% chance of exploitation in the next 30 days, higher than 33% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- onekey.com https://onekey.com/blog/security-advisory-remote-command-execution-in-binwalk/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |
| NVD | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |
| GitHub | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | ubi-reader | <0.8.5 |
0.8.5 |
Affected products
- jrspruitt ubi_reader
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/jrspruitt/ubi_reader/pull/57
web, patch, third-party-advisory
-
github.com
/jrspruitt/ubi_reader/commit/d5d68e6b1b9f7070c29df5f67fc060f579ae9139
web
-
onekey.com
/blog/security-advisory-remote-command-execution-in-binwalk/
exploit, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-0591
advisory
-
github.com
/jrspruitt/ubi_reader
package
-
github.com
/pypa/advisory-database/tree/main/vulns/ubi-reader/PYSEC-2023-51.yaml
web
-
onekey.com
/blog/security-advisory-remote-command-execution-in-binwalk
web
-
github.com
/advisories/GHSA-vp2x-3mc3-3cj4
advisory
Sources
- CVE List CVE-2023-0591
- GitHub Advisory GHSA-vp2x-3mc3-3cj4
- NVD CVE-2023-0591
- OSV PYSEC-2023-51
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.