CVE-2023-50255
Zip Path Traversal in Deepin-Compressor
Deepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there's a path traversal vulnerability in deepin-compressor that can be exploited to achieve Remote Command Execution on the target system upon opening crafted archives. Users are advised to update to version 5.12.21 which addresses the issue. There are no known workarounds for this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Zip Path Traversal in Deepin-Compressor
Deepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there's a path traversal vulnerability in deepin-compressor that can be exploited to achieve Remote Command Execution on the target system upon opening crafted archives. Users are advised to update to version 5.12.21 which addresses the issue. There are no known workarounds for this vulnerability.
- Record
CVE-2023-50255- CVSS 3.1
- 9.3 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N - Weakness
- CWE-23, CWE-26, CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2023-55070
Deepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there's a path traversal vulnerability in deepin-compressor that can be exploited to achieve Remote Command Execution on the target system upon opening crafted archives. Users are advised to update to version 5.12.21 which addresses the issue. There are no known workarounds for this vulnerability.
- Record
EUVD-2023-55070- CVSS 3.1
- 9.3 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N - Updated
- 2026-11-03
NVD
Deepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there's a path traversal vulnerability in deepin-compressor that can be exploited to achieve Remote Command Execution on the target system upon opening crafted archives. Users are advised to update to version 5.12.21 which addresses the issue. There are no known workarounds for this vulnerability.
- Record
CVE-2023-50255- CVSS 3.1
- 9.3 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-22, CWE-23, CWE-26
- Updated
- 2026-11-02
OSV
Zip Path Traversal in Deepin-Compressor
Deepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there's a path traversal vulnerability in deepin-compressor that can be exploited to achieve Remote Command Execution on the target system upon opening crafted archives. Users are advised to update to version 5.12.21 which addresses the issue. There are no known workarounds for this vulnerability.
- Record
CVE-2023-50255- CVSS 3.1
- 9.3 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N - Weakness
- CWE-22, CWE-23, CWE-26
- Updated
- 2026-11-02
OSVOESA-2026-3506
deepin-compressor security update
.
Security Fix(es):
Deepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there's a path traversal vulnerability in deepin-compressor that can be exploited to achieve Remote Command Execution on the target system upon opening crafted archives. Users are advised to update to version 5.12.21 which addresses the issue. There are no known workarounds for this vulnerability. (CVE-2023-50255)
- Record
OESA-2026-3506- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-3507
deepin-compressor security update
.
Security Fix(es):
Deepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there's a path traversal vulnerability in deepin-compressor that can be exploited to achieve Remote Command Execution on the target system upon opening crafted archives. Users are advised to update to version 5.12.21 which addresses the issue. There are no known workarounds for this vulnerability. (CVE-2023-50255)
- Record
OESA-2026-3507- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVOESA-2026-3508
deepin-compressor security update
.
Security Fix(es):
Deepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there's a path traversal vulnerability in deepin-compressor that can be exploited to achieve Remote Command Execution on the target system upon opening crafted archives. Users are advised to update to version 5.12.21 which addresses the issue. There are no known workarounds for this vulnerability. (CVE-2023-50255)
- Record
OESA-2026-3508- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-3509
deepin-compressor security update
.
Security Fix(es):
Deepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there's a path traversal vulnerability in deepin-compressor that can be exploited to achieve Remote Command Execution on the target system upon opening crafted archives. Users are advised to update to version 5.12.21 which addresses the issue. There are no known workarounds for this vulnerability. (CVE-2023-50255)
- Record
OESA-2026-3509- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2023:0423-1 No score
Security update for deepin-compressor
This update for deepin-compressor fixes the following issues:
- CVE-2023-50255: Fix Zip Path Traversal (boo#1218428)
- Record
openSUSE-SU-2023:0423-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2023:0424-1 No score
Security update for deepin-compressor
This update for deepin-compressor fixes the following issues:
- CVE-2023-50255: Fix Zip Path Traversal (boo#1218428)
- Record
openSUSE-SU-2023:0424-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13541-1 No score
deepin-compressor-5.12.13-2.1 on GA media
These are all security issues fixed in the deepin-compressor-5.12.13-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13541-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
deepin-compressoropenEuler:20.03-LTS-SP4 |
before 5.10.11-4.oe2003sp4 | 5.10.11-4.oe2003sp4 |
deepin-compressoropenEuler:22.03-LTS-SP4 |
before 5.12.13-4.oe2203sp4 | 5.12.13-4.oe2203sp4 |
deepin-compressoropenEuler:24.03-LTS-SP1 |
before 5.12.13-4.oe2403sp1 | 5.12.13-4.oe2403sp1 |
deepin-compressoropenEuler:24.03-LTS-SP3 |
before 5.12.13-4.oe2403sp3 | 5.12.13-4.oe2403sp3 |
deepin-compressorSUSE:Package Hub 15 SP5 |
before 5.12.13-bp155.2.3.1 | 5.12.13-bp155.2.3.1 |
deepin-compressoropenSUSE:Leap 15.5 |
before 5.12.13-bp155.2.3.1 | 5.12.13-bp155.2.3.1 |
deepin-compressorSUSE:Package Hub 15 SP4 |
before 5.12.2-bp154.2.3.1 | 5.12.2-bp154.2.3.1 |
deepin-compressoropenSUSE:Leap 15.4 |
before 5.12.2-bp154.2.3.1 | 5.12.2-bp154.2.3.1 |
deepin-compressoropenSUSE:Tumbleweed |
before 5.12.13-2.1 | 5.12.13-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-50255 is a critical vulnerability (CVSS 9.3) in Deepin Deepin-compressor, published December 27, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.05%, the 64th percentile. Fixed in deepin-compressor 5.10.11-4.oe2003sp4.
References
github.com/linuxdeepin/developer-center/security/advisories/GHSA-rw5r-8p9h-3gp2
nvd.nist.gov/vuln/detail/CVE-2023-50255
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-3506
Show 6 moreShow less
lists.opensuse.org/archives/list/[email protected]/thread/E6RI57PVHBNFGBEIH77ZL73GRPMDNIGO
bugzilla.suse.com/1218428
suse.com/security/cve/CVE-2023-50255