CVE-2023-5588 json
kphrx pleroma pack.ex Pleroma.Emoji.Pack path traversal
published 2023-10-15 3 y ago modified 2026-06-17 4 mo ago also GHSA-2c28-m2m7-mf55 , EUVD-2023-2617
- cvss
- 2.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 53%
- public exploits
- 0
- none known
Summary
A vulnerability was found in kphrx pleroma. It has been classified as problematic. This affects the function Pleroma.Emoji.Pack of the file lib/pleroma/emoji/pack.ex. The manipulation of the argument name leads to path traversal. The complexity of an attack is rather high. The exploitability is told to be difficult. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named 2c795094535537a8607cc0d3b7f076a609636f40. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-242187.
Patch / fix
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.71% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 2.6 | CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N |
| CNA | 3.0 | 2.6 | CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N |
| CNA | 2.0 | 1.4 | AV:A/AC:H/Au:S/C:P/I:N/A:N |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.0 | 2.6 | CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| hex | pleroma | <2.5.3 |
2.5.3 |
Affected products
- kphrx pleroma
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/kphrx/pleroma/pull/197
issue-tracking, web, patch, vendor-advisory
-
github.com
/kphrx/pleroma/commit/2c795094535537a8607cc0d3b7f076a609636f40
patch, web
-
vuldb.com
/?id.242187
vdb-entry, technical-description, web, third-party-advisory
-
vuldb.com
/?ctiid.242187
signature, permissions-required, web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-5588
advisory
-
github.com
/kphrx/pleroma
package
-
github.com
/kphrx/pleroma/commits/v2.5.3
web
Sources
- CVE List CVE-2023-5588
- GitHub Advisory GHSA-2c28-m2m7-mf55
- NVD CVE-2023-5588
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.