CVE-2023-28371
In Stellarium through 1.2, attackers can write to files that are typically unintended, such as...
In Stellarium through 1.2, attackers can write to files that are typically unintended, such as ones with absolute pathnames or .. directory traversal.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In Stellarium through 1.2, attackers can write to files that are typically unintended, such as ones with absolute pathnames or .. directory traversal.
- Record
CVE-2023-28371- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
In Stellarium through 1.2, attackers can write to files that are typically unintended, such as ones with absolute pathnames or .. directory traversal.
- Record
CVE-2023-28371- Updated
- 2026-11-02
EUVDEUVD-2023-32067
In Stellarium through 1.2, attackers can write to files that are typically unintended, such as ones with absolute pathnames or .. directory traversal.
- Record
EUVD-2023-32067- CVSS
- 0.0 None
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-7vmm-m8vp-g5h3
In Stellarium through 1.2, attackers can write to files that are typically unintended, such as...
In Stellarium through 1.2, attackers can write to files that are typically unintended, such as ones with absolute pathnames or .. directory traversal.
- Record
GHSA-7vmm-m8vp-g5h3- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-28371
In Stellarium through 1.2, attackers can write to files that are typically unintended, such as ones with absolute pathnames or .. directory traversal.
- Record
DEBIAN-CVE-2023-28371- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-28371
In Stellarium through 1.2, attackers can write to files that are typically unintended, such as ones with absolute pathnames or .. directory traversal.
- Record
UBUNTU-CVE-2023-28371- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSV No score
In Stellarium through 1.2, attackers can write to files that are typically unintended, such as ones with absolute pathnames or .. directory traversal.
- Record
CVE-2023-28371- Updated
- 2026-11-02
OSVMGASA-2023-0129 No score
Updated stellarium packages fix security vulnerability
Attackers can write to files that are typically unintended, such as ones with absolute pathnames or .. directory traversal. (CVE-2023-28371)
- Record
MGASA-2023-0129- Updated
- 2026-11-02
OSVopenSUSE-SU-2023:0097-1 No score
Security update for stellarium
This update for stellarium fixes the following issues:
- CVE-2023-28371: Fixed arbitrary file write issue. (boo#1209285)
- Record
openSUSE-SU-2023:0097-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12819-1 No score
stellarium-23.1-1.1 on GA media
These are all security issues fixed in the stellarium-23.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12819-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
stellariumDebian:12 |
All versions, plus listed versions 0.22.2-123.3-123.4-123.4-224.1-1 Show 7 moreShow less24.2-124.3-125.4-126.1-126.2-126.2-226.3-1 |
None known |
stellariumDebian:13 |
before 23.3-1 | 23.3-1 |
stellariumDebian:14 |
before 23.3-1 | 23.3-1 |
stellariumMageia:8 |
before 0.21.3-1.1.mga8 | 0.21.3-1.1.mga8 |
stellariumUbuntu:16.04:LTS |
All versions, plus listed versions 0.13.3-20.14.0-10.14.1-10.14.1-20.14.2-10.14.3-1 |
None known |
stellariumUbuntu:18.04:LTS |
All versions, plus listed versions 0.16.0-10.16.1-10.17.0-10.18.0-1 |
None known |
stellariumUbuntu:20.04:LTS |
All versions, plus listed versions 0.19.1-20.19.2-10.19.3-10.19.3-1build1 |
None known |
stellariumUbuntu:22.04:LTS |
All versions, plus listed versions 0.20.4-3 |
None known |
stellariumUbuntu:24.04:LTS |
All versions, plus listed versions 0.22.2-123.3-123.4-223.4-2build123.4-2build223.4-2build3 |
None known |
stellariumUbuntu:25.10 |
All versions, plus listed versions 24.3-1build3 |
None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
stellariumUbuntu:26.10 |
All versions, plus listed versions 25.4-126.2-1 |
None known |
stellariumUbuntu:26.04:LTS |
All versions, plus listed versions 24.3-1build324.3-1build425.4-1 |
None known |
stellariumSUSE:Package Hub 15 SP4 |
before 0.21.2-bp154.2.3.1 | 0.21.2-bp154.2.3.1 |
stellariumopenSUSE:Leap 15.4 |
before 0.21.2-bp154.2.3.1 | 0.21.2-bp154.2.3.1 |
stellariumopenSUSE:Tumbleweed |
before 23.1-1.1 | 23.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-28371 is a critical vulnerability (CVSS 9.8) in Stellarium, published March 15, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.54%, the 75th percentile. Fixed in stellarium 23.3-1.
References
github.com/Stellarium/stellarium/commit/1261f74dc4aa6bbd01ab514343424097f8cf46b7
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KG6UNRAOYZJSMIUELY3MMJ5J6LIUZXLT
Show 15 moreShow less
nvd.nist.gov/vuln/detail/CVE-2023-28371
security-tracker.debian.org/tracker/CVE-2023-28371
advisories.mageia.org/MGASA-2023-0129.html
bugs.mageia.org/show_bug.cgi?id=31742
ubuntu.com/security/CVE-2023-28371
cve.org/CVERecord?id=CVE-2023-28371
lists.opensuse.org/archives/list/[email protected]/thread/2ME5VNXZUQUFZZSORKCD3PXXIXMS2DUP
bugzilla.suse.com/1209285
suse.com/security/cve/CVE-2023-28371