{"id":"CVE-2023-2316","aliases":["EUVD-2023-33820","GHSA-9f2q-mg3j-68hc"],"status":"published","title":"Typora Local File Disclosure","description":"Improper path handling in Typora before 1.6.7 on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers via \"typora://app/\u003cabsolute-path\u003e\". \n\nThis vulnerability can be exploited if a user opens a malicious markdown file in Typora, or copies text from a malicious webpage and paste it into Typora.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00661,"percentile":0.51947,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2023-08-19T05:34:20Z","modified":"2026-06-17T05:52:16Z","products":[{"vendor":"typora","product":"typora"},{"vendor":"unknown","product":"typora"}],"references":[{"url":"https://support.typora.io/What's-New-1.6/","tags":["release-notes","x_transferred","Vendor Advisory"]},{"url":"https://starlabs.sg/advisories/23/23-2316/","tags":["third-party-advisory","x_transferred","Exploit","Mitigation","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-2316"},{"url":"https://starlabs.sg/advisories/23/23-2316"},{"url":"https://support.typora.io/What's-New-1.6"},{"url":"https://github.com/advisories/GHSA-9f2q-mg3j-68hc"}],"sources":{"cve":[{"id":"CVE-2023-2316","title":"Typora Local File Disclosure","description":"Improper path handling in Typora before 1.6.7 on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers via \"typora://app/\u003cabsolute-path\u003e\". \n\nThis vulnerability can be exploited if a user opens a malicious markdown file in Typora, or copies text from a malicious webpage and paste it into Typora.\n\n\n\n\n\n","status":"published","published":"2023-08-19T05:34:20.39Z","modified":"2024-10-07T19:59:27.236Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:35:24.004321Z"}],"euvd":[{"id":"EUVD-2023-33820","description":"Improper path handling in Typora before 1.6.7 on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers via \"typora://app/\u003cabsolute-path\u003e\". \n\nThis vulnerability can be exploited if a user opens a malicious markdown file in Typora, or copies text from a malicious webpage and paste it into Typora.\n\n\n\n\n\n","status":"published","published":"2023-08-19T05:34:20Z","modified":"2024-10-07T19:59:27Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T00:27:46.330731Z"}],"ghsa":[{"id":"GHSA-9f2q-mg3j-68hc","title":"Improper path handling in Typora before 1.6.7 on Windows and Linux allows a crafted webpage to...","description":"Improper path handling in Typora before 1.6.7 on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers via \"typora://app/\u003cabsolute-path\u003e\". \n\nThis vulnerability can be exploited if a user opens a malicious markdown file in Typora, or copies text from a malicious webpage and paste it into Typora.\n\n\n\n\n\n","status":"published","published":"2023-08-19T06:30:25Z","modified":"2024-04-04T07:03:32Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:56:48.229282Z"}],"nvd":[{"id":"CVE-2023-2316","description":"Improper path handling in Typora before 1.6.7 on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers via \"typora://app/\u003cabsolute-path\u003e\". \n\nThis vulnerability can be exploited if a user opens a malicious markdown file in Typora, or copies text from a malicious webpage and paste it into Typora.\n\n\n\n\n\n","status":"published","published":"2023-08-19T06:15:46.42Z","modified":"2026-06-17T05:52:16.05Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:08:24.487686Z"}]}}