TI-2023-00560 Aliases CVE-2023-0591 GHSA-vp2x-3mc3-3cj4

Path Traversal in ubi_reader

MEDIUM 58CWE-22Published 2023-01-31 · Updated 2025-03-26

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

ubireader_extract_files is vulnerable to path traversal when run against specifically crafted UBIFS files, allowing the attacker to overwrite files outside of the extraction directory (provided the process has write access to that file or directory). This is due to the fact that a node name (dent_node.name) is considered trusted and joined to the extraction directory path during processing, then the node content is written to that joined path. By crafting a malicious UBIFS file with node names holding path traversal payloads (e.g. ../../tmp/outside.txt), it's possible to force ubi_reader to write outside of the extraction directory. This issue affects ubi-reader before 0.8.5.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.0039 33rd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed ubi_reader ( jrspruitt): 0.8.5ubi-reader (PyPI): 0.8.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
jrspruitt	ubi_reader	before 0.8.5	0.8.5	Patch available	CNA
—	ubi-reader (PyPI)	before 0.8.5	0.8.5	Patch available	GHSA-vp2x-3mc3-3cj4

ubi_reader Vendor jrspruitt Affected before 0.8.5 Fixed in 0.8.5 Patch available CNA
ubi-reader (PyPI) Vendor— Affected before 0.8.5 Fixed in 0.8.5 Patch available GHSA-vp2x-3mc3-3cj4

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:ubi_reader_project:ubi_reader::::::::	before 0.8.5	Vulnerable	Ubi Reader Project

cpe:2.3:a:ubi_reader_project:ubi_reader:*:*:*:*:*:*:*:* Versions before 0.8.5 Vulnerable ·Ubi Reader Project

Remediation

Fix · CNA ubi_reader ( jrspruitt) Fixed in 0.8.5
Fix · GHSA-vp2x-3mc3-3cj4 ubi-reader (PyPI) Fixed in 0.8.5 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-0591
2026-10-03 Alias added: GHSA-vp2x-3mc3-3cj4

References

Other 4

TI-2022-04176 UBI Reader UBIFS File output.py ubireader_extract_files path traversal CVSS 3.1HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences