Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.8
CVE-2023-0591: ubi-reader can overwrite files outside extraction folder
CVE-2023-0591 · published 3 years ago
Summary
The ubi_reader tool (versions before 0.8.5) may write files to any location it has permission to access when it extracts specially crafted UBIFS files. An attacker could cause the program to replace or create files outside the intended folder, potentially affecting system configuration or data. Update ubi_reader to version 0.8.5 or newer, and avoid processing untrusted UBIFS files.
What to do
- Update onekey ubi-reader to version 0.8.5.
- Update ubi_reader_project ubi_reader to version 0.8.5 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | onekey | ubi-reader |
< 0.8.5 Fix: upgrade to 0.8.5
|
| – | ubi_reader_project | ubi_reader |
< 0.8.5 cpe:2.3:a:ubi_reader_project:ubi_reader:*:*:*:*:*:*:*:* |
Original advisory text
Path Traversal in ubi_reader
ubireader_extract_files is vulnerable to path traversal when run against specifically crafted UBIFS files, allowing the attacker to overwrite files outside of the extraction directory (provided the process has write access to that file or directory).
This is due to the fact that a node name (dent_node.name) is considered trusted and joined to the extraction directory path during processing, then the node content is written to that joined path. By crafting a malicious UBIFS file with node names holding path traversal payloads (e.g. ../../tmp/outside.txt), it's possible to force ubi_reader to write outside of the extraction directory.
This issue affects ubi-reader before 0.8.5.
References
- https://github.com/jrspruitt/ubi_reader/commit/d5d68e6b1b9f7070c29df5f67fc060f57...
- https://github.com/pypa/advisory-database/tree/main/vulns/ubi-reader/PYSEC-2023-...
- https://onekey.com/blog/security-advisory-remote-command-execution-in-binwalk
- https://github.com/advisories/GHSA-vp2x-3mc3-3cj4
- https://nvd.nist.gov/vuln/detail/CVE-2023-0591 Vendor Advisory
- https://github.com/jrspruitt/ubi_reader/pull/57 Patch
- https://onekey.com/blog/security-advisory-remote-command-execution-in-binwalk/ Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/0xxx/CVE-2023-0591.j... Vendor Advisory
- https://github.com/jrspruitt/ubi_reader Product
- https://pypi.org/project/ubi-reader/ Product
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-22Path Traversal
Timeline
Published31 Jan 2023
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta