Obsidian Local File Disclosure
CVE-2023-2110

8.2HIGH

Key Information:

Vendor

Obsidian

Status
Obsidian
Vendor
CVE Published:
19 August 2023

What is CVE-2023-2110?

An improper path handling vulnerability exists in the Obsidian Desktop application, allowing attackers to potentially access local files. When a user opens a specially crafted markdown file or pastes text from a compromised webpage into the app, it can trigger this vulnerability. This may lead to sensitive data being exfiltrated to remote servers, raising significant security concerns for users across Windows, Linux, and macOS platforms.

Affected Version(s)

Obsidian Windows 0 < 1.2.8

References

https://obsidian.md/changelog/2023-05-03-desktop-v1.2.8/
release-notes
https://starlabs.sg/advisories/23/23-2110/
third-party-advisory

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Li Jiantao (@CurseRed) of STAR Labs SG Pte. Ltd. (@starlabs_sg)
.