VULNERABILITY INTELLIGENCE

CVE-2023-0593

CVSS score5.5 MEDIUM

EPSS probability0.35%

CISA KEVNot currently listed

Published2023-01-31

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Description

A path traversal vulnerability affects yaffshiv YAFFS filesystem extractor. By crafting a malicious YAFFS file, an attacker could force yaffshiv to write outside of the extraction directory. This issue affects yaffshiv up to version 0.1 included, which is the most recent at time of publication.

Weakness classification

research@onekey.com: CWE-22
nvd@nist.gov: CWE-22

Primary references

research@onekey.com — Patch, Third Party Advisory
research@onekey.com — Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory