CVE-2023-38633

Deeper analysis

A directory traversal vulnerability exists in the URL decoder of librsvg before version 2.56.3. The flaw, tracked as CWE-22, allows an attacker to supply a crafted href attribute in an xi:include element, such as ".?../../../../../../../../../../etc/passwd", to read files from the local filesystem outside the intended scope. The issue received a CVSS 3.1 score of 5.5 reflecting local access, low attack complexity, and high impact on confidentiality with no integrity or availability effects.

Local or remote attackers who can supply SVG content processed by the vulnerable library can exploit the flaw to disclose arbitrary files readable by the process. The attack requires no user interaction beyond rendering the malicious SVG and succeeds against any application that uses the affected librsvg version for SVG handling.

Advisories and vendor references indicate that the issue is resolved in librsvg 2.56.3, with distribution packages and upstream updates available through GNOME and downstream vendors such as SUSE. Security practitioners should verify that systems have applied the patched version and review any SVG processing pipelines that rely on librsvg.

The EPSS score has remained near 0.44 with only minimal movement between current and peak values, providing no indication of sharply rising exploitation interest after disclosure.