Engrampa Archive Manager Vulnerable to Path Traversal Attack

CVE-2023-52138

What is CVE-2023-52138?

Engrampa, the archive manager for MATE, has a vulnerability that allows for Path Traversal through improperly handled symlink extraction during the processing of CPIO archives. This flaw can lead to arbitrary file writes, potentially enabling remote attackers to execute arbitrary commands on the target system. When a user extracts a maliciously crafted CPIO or ISO archive, the Engrampa Archive Manager does not adequately verify the symlink path, creating an avenue for exploitation. This vulnerability was addressed in commit 63d5dfa and underscores the importance of securing archive management tools against such exploits.

References