Skip to content
Fencer Vulns
critical 9.3

CVE-2023-50255 json

Zip Path Traversal in Deepin-Compressor

published 2023-12-27 2 y ago modified 2026-06-17 4 mo ago also EUVD-2023-55070

cvss
9.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 64%
public exploits
0
none known

Summary

Deepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there's a path traversal vulnerability in deepin-compressor that can be exploited to achieve Remote Command Execution on the target system upon opening crafted archives. Users are advised to update to version 5.12.21 which addresses the issue. There are no known workarounds for this vulnerability.

Patch / fix

  • deepin deepin-compressor 5.12.21
  • deepin-compressor openSUSE Tumbleweed 5.12.13-2.1
  • deepin-compressor Package Hub 15 SP4, openSUSE Leap 15.4 5.12.2-bp154.2.3.1
  • deepin-compressor Package Hub 15 SP5, openSUSE Leap 15.5 5.12.13-bp155.2.3.1

opensuse advisories openSUSE-SU-2024:13541-1openSUSE-SU-2023:0424-1openSUSE-SU-2023:0423-1

Exploit prediction

1.05% chance of exploitation in the next 30 days, higher than 64% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/linuxdeepin/developer-center/security/advisories/GHSA-rw5r-8p9h-3gp2 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

  • linuxdeepin developer-center

Classification

Weakness
  • CWE-23 Relative Path Traversal
  • CWE-26 Path Traversal: '/dir/../filename'
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.