{"id":"CVE-2023-38633","aliases":["ALPINE-CVE-2023-38633","ALSA-2023:5081","DEBIAN-CVE-2023-38633","DSA-5484-1","EUVD-2023-42432","GHSA-jf6v-gw88-w63q","JLSEC-2026-512","MGASA-2023-0259","OESA-2023-1582","RHSA-2023:4809","RHSA-2023:5081","SUSE-SU-2023:3021-1","SUSE-SU-2023:3208-1","UBUNTU-CVE-2023-38633","USN-6266-1","openSUSE-SU-2024:13500-1"],"status":"published","title":"A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local...","description":"A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by href=\".?../../../../../../../../../../etc/passwd\" in an xi:include element.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.02325,"percentile":0.83633,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2023-07-22T00:00:00Z","modified":"2026-11-03T06:32:01Z","fixes":[{"ecosystem":"Alpine:v3.18","package":"librsvg","fixed_in":["2.56.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"librsvg","fixed_in":["2.56.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"librsvg","fixed_in":["2.56.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"librsvg","fixed_in":["2.56.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"librsvg","fixed_in":["2.56.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"librsvg","fixed_in":["2.56.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"librsvg","fixed_in":["2.56.3-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"librsvg2","fixed_in":["2.50.7-1.el9_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"librsvg2-devel","fixed_in":["2.50.7-1.el9_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"librsvg2-tools","fixed_in":["2.50.7-1.el9_2.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"librsvg","fixed_in":["2.54.7+dfsg-1~deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"librsvg","fixed_in":["2.54.7+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"librsvg","fixed_in":["2.54.7+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"librsvg","fixed_in":["2.50.3+dfsg-1+deb11u1"],"sources":["osv"]},{"ecosystem":"Julia","package":"Librsvg_jll","fixed_in":["2.54.7+0"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"librsvg","fixed_in":["2.50.3-1.2.mga8"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"librsvg","fixed_in":["2.56.0-1.1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"librsvg2","fixed_in":["2.50.5-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"librsvg2","fixed_in":["2.50.5-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"librsvg2","fixed_in":["2.50.5-4.oe2203sp2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"librsvg2","fixed_in":["2.50.5-6.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP2","package":"librsvg2","fixed_in":["2.50.5-4.oe2203sp2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"librsvg2","fixed_in":["0:2.50.7-1.el9_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"librsvg2-debuginfo","fixed_in":["0:2.50.7-1.el9_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"librsvg2-debugsource","fixed_in":["0:2.50.7-1.el9_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"librsvg2-devel","fixed_in":["0:2.50.7-1.el9_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"librsvg2-tools","fixed_in":["0:2.50.7-1.el9_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"librsvg2-tools-debuginfo","fixed_in":["0:2.50.7-1.el9_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"librsvg2","fixed_in":["0:2.50.7-1.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"librsvg2-debuginfo","fixed_in":["0:2.50.7-1.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"librsvg2-debugsource","fixed_in":["0:2.50.7-1.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"librsvg2-devel","fixed_in":["0:2.50.7-1.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"librsvg2-tools","fixed_in":["0:2.50.7-1.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"librsvg2-tools-debuginfo","fixed_in":["0:2.50.7-1.el9_2.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"librsvg","fixed_in":["2.52.10-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"librsvg","fixed_in":["2.52.10-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"librsvg","fixed_in":["2.52.10-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"librsvg","fixed_in":["2.52.10-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP4","package":"librsvg","fixed_in":["2.52.10-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP5","package":"librsvg","fixed_in":["2.52.10-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"librsvg","fixed_in":["2.52.10-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.3","package":"librsvg","fixed_in":["2.52.10-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.4","package":"librsvg","fixed_in":["2.52.10-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"librsvg","fixed_in":["2.52.10-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"librsvg","fixed_in":["2.52.10-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"librsvg","fixed_in":["2.46.7-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"librsvg","fixed_in":["2.46.7-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"librsvg","fixed_in":["2.46.7-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"librsvg","fixed_in":["2.46.7-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"librsvg","fixed_in":["2.46.7-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"librsvg","fixed_in":["2.46.7-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"librsvg","fixed_in":["2.46.7-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.2","package":"librsvg","fixed_in":["2.46.7-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.2","package":"librsvg","fixed_in":["2.46.7-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"librsvg","fixed_in":["2.46.7-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7","package":"librsvg","fixed_in":["2.46.7-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"librsvg","fixed_in":["2.46.7-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"librsvg","fixed_in":["2.48.9-1ubuntu0.20.04.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"librsvg","fixed_in":["2.52.5+dfsg-3ubuntu0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.18","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.42.3"},{"fixed":"2.56.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.42.3"},{"fixed":"2.56.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.42.3"},{"fixed":"2.56.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.42.3"},{"fixed":"2.56.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.42.3"},{"fixed":"2.56.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.42.3"},{"fixed":"2.56.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.42.3"},{"fixed":"2.56.3-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"librsvg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.50.7-1.el9_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"librsvg2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.50.7-1.el9_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"librsvg2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.50.7-1.el9_2.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.54.7+dfsg-1~deb12u1"}]}],"versions":["2.54.5+dfsg-1","2.54.5+dfsg-2","2.54.5+dfsg-3"]},{"source":"osv","ecosystem":"Debian:13","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.54.7+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.54.7+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.50.3+dfsg-1+deb11u1"}]}],"versions":["2.50.3+dfsg-1"]},{"source":"osv","ecosystem":"Debian:12","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.54.7+dfsg-1~deb12u1"}]}],"versions":["2.54.5+dfsg-1","2.54.5+dfsg-2","2.54.5+dfsg-3"]},{"source":"osv","ecosystem":"Julia","package":"Librsvg_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"2.52.4+0"},{"fixed":"2.54.7+0"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.50.3-1.2.mga8"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.0-1.1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"librsvg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.50.5-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"librsvg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.50.5-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"librsvg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.50.5-4.oe2203sp2"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"librsvg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.50.5-6.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"librsvg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.50.5-4.oe2203sp2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"librsvg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.50.7-1.el9_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"librsvg2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.50.7-1.el9_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"librsvg2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.50.7-1.el9_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"librsvg2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.50.7-1.el9_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"librsvg2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.50.7-1.el9_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"librsvg2-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.50.7-1.el9_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"librsvg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.50.7-1.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"librsvg2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.50.7-1.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"librsvg2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.50.7-1.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"librsvg2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.50.7-1.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"librsvg2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.50.7-1.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"librsvg2-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.50.7-1.el9_2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.10-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.10-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.10-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.10-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP4","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.10-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP5","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.10-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.10-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.10-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.4","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.10-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.10-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.10-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.46.7-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.46.7-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.46.7-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.46.7-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.46.7-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.46.7-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.46.7-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.46.7-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.46.7-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.46.7-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.46.7-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.46.7-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.48.9-1ubuntu0.20.04.4"}]}],"versions":["2.44.14-1","2.46.4-1","2.46.4-1ubuntu1","2.48.0-1","2.48.2-1","2.48.7-1ubuntu0.20.04.1","2.48.9-1ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.5+dfsg-3ubuntu0.2"}]}],"versions":["2.50.7+dfsg-1","2.50.7+dfsg-2","2.52.5+dfsg-1ubuntu1","2.52.5+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.48.9-1ubuntu0.20.04.4"}]}],"versions":["2.44.14-1","2.46.4-1","2.46.4-1ubuntu1","2.48.0-1","2.48.2-1","2.48.7-1ubuntu0.20.04.1","2.48.9-1ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.5+dfsg-3ubuntu0.2"}]}],"versions":["2.50.7+dfsg-1","2.50.7+dfsg-2","2.52.5+dfsg-1ubuntu1","2.52.5+dfsg-3"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"gnome","product":"librsvg"}],"references":[{"url":"https://gitlab.gnome.org/GNOME/librsvg/-/issues/996","tags":["x_transferred","Exploit","Issue Tracking","Vendor Advisory","report","web"]},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1213502","tags":["x_transferred","Issue Tracking","Patch","Third Party Advisory","report","web"]},{"url":"https://gitlab.gnome.org/GNOME/librsvg/-/releases/2.56.3","tags":["x_transferred","Release Notes","web"]},{"url":"http://seclists.org/fulldisclosure/2023/Jul/43","tags":["mailing-list","x_transferred","Mailing List","Not Applicable","Third Party Advisory","article","web"]},{"url":"http://www.openwall.com/lists/oss-security/2023/07/27/1","tags":["mailing-list","x_transferred","Exploit","Mailing List","Third Party Advisory","article","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R5BCXT5GW6RCL45ZUHUZR4CJG2BAFDVC/","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/422NTIHIEBRASIG2DWXYBH4ADYMHY626/","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.debian.org/security/2023/dsa-5484","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20230831-0011/","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2023/09/06/10","tags":["mailing-list","x_transferred","Mailing List","article","web"]},{"url":"https://www.canva.dev/blog/engineering/when-url-parsers-disagree-cve-2023-38633/","tags":["x_transferred","Exploit","Technical Description","Third Party Advisory","article","web"]},{"url":"https://news.ycombinator.com/item?id=37415799","tags":["x_transferred","Issue Tracking","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-38633","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R5BCXT5GW6RCL45ZUHUZR4CJG2BAFDVC/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/422NTIHIEBRASIG2DWXYBH4ADYMHY626/"},{"url":"https://github.com/advisories/GHSA-jf6v-gw88-w63q"},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-38633","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:5081","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-38633","tags":["report"]},{"url":"https://bugzilla.redhat.com/2224945","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-5081.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38633.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-38633","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0259.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32210","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2023/07/27/1","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1582","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:4809","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2224945","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4809.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-38633","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5081.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233021-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1213502","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-38633","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233208-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-38633","tags":["report"]},{"url":"https://marc.info/?i=73b96607-5080-939c-d354-33da849d195d@oracle.com","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6266-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-38633","description":"A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by href=\".?../../../../../../../../../../etc/passwd\" in an xi:include element.","status":"published","published":"2023-07-22T00:00:00Z","modified":"2024-08-02T17:46:56.6Z","updated_at":"2026-11-02T14:35:29.772612Z"}],"euvd":[{"id":"EUVD-2023-42432","description":"A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by href=\".?../../../../../../../../../../etc/passwd\" in an xi:include element.","status":"published","published":"2023-07-22T00:00:00Z","modified":"2024-08-02T17:46:56Z","updated_at":"2026-11-03T03:50:02.733403Z"}],"ghsa":[{"id":"GHSA-jf6v-gw88-w63q","title":"A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local...","description":"A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by href=\".?../../../../../../../../../../etc/passwd\" in an xi:include element.","status":"published","published":"2023-07-22T18:30:23Z","modified":"2024-02-02T05:07:58Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:55:31.84746Z"}],"nvd":[{"id":"CVE-2023-38633","description":"A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by href=\".?../../../../../../../../../../etc/passwd\" in an xi:include element.","status":"published","published":"2023-07-22T17:15:09.81Z","modified":"2026-06-17T06:10:52.427Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:08:17.044696Z"}],"osv":[{"id":"ALPINE-CVE-2023-38633","description":"A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by href=\".?../../../../../../../../../../etc/passwd\" in an xi:include element.","status":"published","published":"2023-07-22T17:15:09.81Z","modified":"2026-11-03T06:32:01.783073427Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T07:18:15.355745Z"},{"id":"DEBIAN-CVE-2023-38633","description":"A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by href=\".?../../../../../../../../../../etc/passwd\" in an xi:include element.","status":"published","published":"2023-07-22T17:15:09.81Z","modified":"2026-10-26T18:03:06.725315667Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:39.980321Z"},{"id":"JLSEC-2026-512","description":"A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by `href=\".?../../../../../../../../../../etc/passwd\"` in an `xi:include` element.","status":"published","published":"2026-05-19T01:34:38.069Z","modified":"2026-07-25T18:24:33.505178703Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"OESA-2023-1582","title":"librsvg2 security update","description":"An SVG library based on cairo.\r\n\r\nSecurity Fix(es):\r\n\r\nA directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by href=\u0026quot;.?../../../../../../../../../../etc/passwd\u0026quot; in an xi:include element.(CVE-2023-38633)","status":"published","published":"2023-09-02T11:06:02Z","modified":"2026-08-18T01:17:48.795731094Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"RHSA-2023:4809","title":"Red Hat Security Advisory: librsvg2 security update","status":"published","published":"2024-09-16T12:49:24Z","modified":"2025-11-22T12:54:52Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RHSA-2023:5081","title":"Red Hat Security Advisory: librsvg2 security update","status":"published","published":"2024-09-16T12:49:33Z","modified":"2025-11-22T12:55:27Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"UBUNTU-CVE-2023-38633","description":"A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by href=\".?../../../../../../../../../../etc/passwd\" in an xi:include element.","status":"published","published":"2023-07-22T17:15:00Z","modified":"2026-04-22T14:09:37.086765Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:21.882004Z"},{"id":"ALSA-2023:5081","title":"Moderate: librsvg2 security update","description":"The librsvg2 packages provide a Scalable Vector Graphics (SVG) library based on the libart library.\n\nSecurity Fix(es):\n\n* librsvg: Arbitrary file read when xinclude href has special characters (CVE-2023-38633)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-09-12T00:00:00Z","modified":"2026-10-29T11:31:30.713622623Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"CVE-2023-38633","description":"A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by href=\".?../../../../../../../../../../etc/passwd\" in an xi:include element.","status":"published","published":"2023-07-22T00:00:00Z","modified":"2026-10-28T02:30:45.253844857Z","updated_at":"2026-11-02T15:44:32.922049Z"},{"id":"DSA-5484-1","title":"librsvg - security update","status":"published","published":"2023-08-27T00:00:00Z","modified":"2026-03-09T02:10:58.374659Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2023-0259","title":"Updated librsvg packages fix security vulnerability","description":"A directory traversal problem in the URL decoder of librsvg before 2.56.3\ncould be used by local or remote attackers to disclose files (on the local\nfilesystem outside of the expected area), as demonstrated by\nhref=\".?../../../../../../../../../../etc/passwd\" in an xi:include\nelement. (CVE-2023-38633)\n","status":"published","published":"2023-09-11T13:07:54Z","modified":"2026-04-16T04:40:43.862840376Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:13500-1","title":"gdk-pixbuf-loader-rsvg-2.57.0-4.1 on GA media","description":"These are all security issues fixed in the gdk-pixbuf-loader-rsvg-2.57.0-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:29:44.586916Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2023:3021-1","title":"Security update for librsvg","description":"This update for librsvg fixes the following issues:\n\nlibrsvg was updated to version 2.52.10:\n \n- CVE-2023-38633: Fixed directory traversal in URI decoder (bsc#1213502).\n","status":"published","published":"2023-07-28T19:43:57Z","modified":"2026-02-04T02:16:37.895804Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"SUSE-SU-2023:3208-1","title":"Security update for librsvg","description":"This update for librsvg fixes the following issues:\n\n  librsvg was updated to version 2.46.7:\n\n  - CVE-2023-38633: Fixed directory traversal in URI decoder (bsc#1213502).\n","status":"published","published":"2023-08-07T13:15:43Z","modified":"2026-02-04T03:14:40.636997Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"USN-6266-1","title":"librsvg vulnerability","description":"Zac Sims discovered that librsvg incorrectly handled decoding URLs. A\nremote attacker could possibly use this issue to read arbitrary files by\nusing an include element.\n","status":"published","published":"2023-08-01T11:43:51Z","modified":"2026-04-22T10:37:10.883314Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}