Catalogue CVE

CVE-2023-52138

engrampa affected and fixed versions

Engrampa is an archive manager for the MATE environment. Engrampa is found to be vulnerable to a Path Traversal vulnerability that can be leveraged to achieve full Remote Command Execution (RCE) on the target. While handling CPIO archives, the Engrampa Archive manager follows symlink, cpio by default will follow stored symlinks while extracting and the Archiver will not check the symlink location, which leads to arbitrary file writes to unintended locations. When the victim extracts the archive, the attacker can craft a malicious cpio or ISO archive to achieve RCE on the target system. This vulnerability was fixed in commit 63d5dfa.

Gravité: Critical · CVSS 9.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Published: Jan 1, 2023, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 1.67% · Oct 29, 2026

Projects and upstream resources

[libmatemixer][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiantrixie	engrampa	`1.26.2-1`	FixedDistribution-reported fixed boundary	[CVE-2023-52138]
Debiantrixie	engrampa	`1.26.2-5`	Fixed	[CVE-2023-52138]
Debiansid	engrampa	`1.26.2-1`	FixedDistribution-reported fixed boundary	[CVE-2023-52138]
Debiansid	engrampa	`1.28.2-1`	Fixed	[CVE-2023-52138]
Debianforky	engrampa	`1.26.2-1`	FixedDistribution-reported fixed boundary	[CVE-2023-52138]
Debianforky	engrampa	`1.28.2-1`	Fixed	[CVE-2023-52138]
Debianbookworm-security	engrampa	`1.26.0-1+deb12u2`	Fixed	[CVE-2023-52138]
Debianbookworm	engrampa	`1.26.0-1+deb12u2`	FixedDistribution-reported fixed boundary	[CVE-2023-52138]

Showing 8 fix observations. All 12 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
UnknownRelease not reported	engrampa	`1.26.0-1+deb12u2`	UnknownSource applicability is not established	Provider not reported
Debianbookworm	engrampa	`1.26.0-1+deb12u2`	FixedDistribution-reported fixed boundary	[CVE-2023-52138]
Debianbookworm-security	engrampa	`1.26.0-1+deb12u2`	Fixed	[CVE-2023-52138]
Debianforky	engrampa	`1.26.2-1`	FixedDistribution-reported fixed boundary	[CVE-2023-52138]
Debianforky	engrampa	`1.28.2-1`	Fixed	[CVE-2023-52138]
Debiansid	engrampa	`1.26.2-1`	FixedDistribution-reported fixed boundary	[CVE-2023-52138]
Debiansid	engrampa	`1.28.2-1`	Fixed	[CVE-2023-52138]
Debiantrixie	engrampa	`1.26.2-1`	FixedDistribution-reported fixed boundary	[CVE-2023-52138]
Debiantrixie	engrampa	`1.26.2-5`	Fixed	[CVE-2023-52138]
Ubuntupro	engrampa	`1.26.0-0ubuntu1`	UnknownSource applicability is not established	[USN-8640-1]Aug 17, 2026, 11:59:12 PM UTC[UBUNTU-CVE-2023-52138]Aug 17, 2026, 11:45:05 PM UTC
Ubuntupro	engrampa	`1.26.0-1ubuntu1`	UnknownSource applicability is not established	[USN-8640-1]Aug 17, 2026, 11:59:12 PM UTC[UBUNTU-CVE-2023-52138]Aug 17, 2026, 11:45:05 PM UTC
Ubuntupro	engrampa	`1.26.0-1ubuntu1+esm1`	UnknownSource applicability is not established	[USN-8640-1]Aug 17, 2026, 11:59:12 PM UTC[UBUNTU-CVE-2023-52138]Aug 17, 2026, 11:45:05 PM UTC

Original provider fields

{
  "package_releases": [
    {
      "name": "engrampa",
      "status": "fixed",
      "release": "sid",
      "version": "1.28.2-1"
    },
    {
      "name": "engrampa",
      "status": "fixed",
      "release": "forky",
      "version": "1.28.2-1"
    },
    {
      "name": "engrampa",
      "status": "fixed",
      "release": "trixie",
      "version": "1.26.2-5"
    },
    {
      "name": "engrampa",
      "status": "fixed",
      "release": "bookworm",
      "version": "1.26.0-1+deb12u2"
    },
    {
      "name": "engrampa",
      "status": "fixed",
      "release": "bookworm-security",
      "version": "1.26.0-1+deb12u2"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1063494,
      "name": "engrampa",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "1.26.2-1"
    },
    {
      "bug": 1063494,
      "name": "engrampa",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "1.26.2-1"
    },
    {
      "bug": 1063494,
      "name": "engrampa",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "1.26.2-1"
    },
    {
      "bug": 1063494,
      "name": "engrampa",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "1.26.0-1+deb12u2"
    }
  ],
  "distribution_packages": [
    {
      "name": "engrampa",
      "fixed_version": "1.26.0-1+deb12u2",
      "applicability_unknown": true
    },
    {
      "name": "engrampa",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.26.0-1ubuntu1+esm1"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "1.26.0-0ubuntu1",
        "1.26.0-1ubuntu1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-8640-1",
      "fixed_version": "1.26.0-1ubuntu1+esm1",
      "provider_source": "pypi",
      "provider_record_id": "USN-8640-1",
      "provider_updated_at": "2026-08-17T23:59:12.850505488Z",
      "applicability_unknown": true
    },
    {
      "name": "engrampa",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.26.0-1ubuntu1+esm1"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "1.26.0-0ubuntu1",
        "1.26.0-1ubuntu1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2023-52138",
      "fixed_version": "1.26.0-1ubuntu1+esm1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2023-52138",
      "provider_updated_at": "2026-08-17T23:45:05.916336185Z",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #1063494]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[engrampa]Inconnu
Détails (4)
- 1.26.0-1+deb12u2 · amd64 · bookworm
  Inconnu · Corrigée: 1.20.2-1+deb10u1, 1.24.1-1+deb11u1, 1.26.0-1+deb12u2, 1.26.2-1
  Version impact unknown
  dsa · engrampa · debian · bookworm; pypi · engrampa · debian · 12; pypi · engrampa · debian · 13; pypi · engrampa · debian · 14; pypi · engrampa · debian · 11; pypi · engrampa · debian · 10
- 1.26.0-1+deb12u2 · arm64 · bookworm
  Inconnu · Corrigée: 1.20.2-1+deb10u1, 1.24.1-1+deb11u1, 1.26.0-1+deb12u2, 1.26.2-1
  Version impact unknown
  dsa · engrampa · debian · bookworm; pypi · engrampa · debian · 12; pypi · engrampa · debian · 13; pypi · engrampa · debian · 14; pypi · engrampa · debian · 11; pypi · engrampa · debian · 10
- 1.26.0-1+deb12u2 · amd64 · bookworm-security
  Inconnu · Corrigée: 1.20.2-1+deb10u1, 1.24.1-1+deb11u1, 1.26.0-1+deb12u2, 1.26.2-1
  Version impact unknown
  dsa · engrampa · debian · bookworm; pypi · engrampa · debian · 12; pypi · engrampa · debian · 13; pypi · engrampa · debian · 14; pypi · engrampa · debian · 11; pypi · engrampa · debian · 10
- 1.26.0-1+deb12u2 · arm64 · bookworm-security
  Inconnu · Corrigée: 1.20.2-1+deb10u1, 1.24.1-1+deb11u1, 1.26.0-1+deb12u2, 1.26.2-1
  Version impact unknown
  dsa · engrampa · debian · bookworm; pypi · engrampa · debian · 12; pypi · engrampa · debian · 13; pypi · engrampa · debian · 14; pypi · engrampa · debian · 11; pypi · engrampa · debian · 10
[engrampa-common]Inconnu
Paquet source: [engrampa]
Détails (4)
- 1.26.0-1+deb12u2 · all · bookworm
  Inconnu · Corrigée: 1.20.2-1+deb10u1, 1.24.1-1+deb11u1, 1.26.0-1+deb12u2, 1.26.2-1
  Version impact unknown
  dsa · engrampa · debian · bookworm; pypi · engrampa · debian · 12; pypi · engrampa · debian · 13; pypi · engrampa · debian · 14; pypi · engrampa · debian · 11; pypi · engrampa · debian · 10
- 1.26.0-1+deb12u2 · all · bookworm
  Inconnu · Corrigée: 1.20.2-1+deb10u1, 1.24.1-1+deb11u1, 1.26.0-1+deb12u2, 1.26.2-1
  Version impact unknown
  dsa · engrampa · debian · bookworm; pypi · engrampa · debian · 12; pypi · engrampa · debian · 13; pypi · engrampa · debian · 14; pypi · engrampa · debian · 11; pypi · engrampa · debian · 10
- 1.26.0-1+deb12u2 · all · bookworm-security
  Inconnu · Corrigée: 1.20.2-1+deb10u1, 1.24.1-1+deb11u1, 1.26.0-1+deb12u2, 1.26.2-1
  Version impact unknown
  dsa · engrampa · debian · bookworm; pypi · engrampa · debian · 12; pypi · engrampa · debian · 13; pypi · engrampa · debian · 14; pypi · engrampa · debian · 11; pypi · engrampa · debian · 10
- 1.26.0-1+deb12u2 · all · bookworm-security
  Inconnu · Corrigée: 1.20.2-1+deb10u1, 1.24.1-1+deb11u1, 1.26.0-1+deb12u2, 1.26.2-1
  Version impact unknown
  dsa · engrampa · debian · bookworm; pypi · engrampa · debian · 12; pypi · engrampa · debian · 13; pypi · engrampa · debian · 14; pypi · engrampa · debian · 11; pypi · engrampa · debian · 10

[Debian 13 (Trixie)]

[engrampa]Inconnu
Détails (2)
- 1.26.2-5 · amd64 · trixie
  Inconnu · Corrigée: 1.20.2-1+deb10u1, 1.24.1-1+deb11u1, 1.26.0-1+deb12u2, 1.26.2-1
  Version impact unknown
  dsa · engrampa · debian · bookworm; pypi · engrampa · debian · 12; pypi · engrampa · debian · 13; pypi · engrampa · debian · 14; pypi · engrampa · debian · 11; pypi · engrampa · debian · 10
- 1.26.2-5 · arm64 · trixie
  Inconnu · Corrigée: 1.20.2-1+deb10u1, 1.24.1-1+deb11u1, 1.26.0-1+deb12u2, 1.26.2-1
  Version impact unknown
  dsa · engrampa · debian · bookworm; pypi · engrampa · debian · 12; pypi · engrampa · debian · 13; pypi · engrampa · debian · 14; pypi · engrampa · debian · 11; pypi · engrampa · debian · 10
[engrampa-common]Inconnu
Paquet source: [engrampa]
Détails (2)
- 1.26.2-5 · all · trixie
  Inconnu · Corrigée: 1.20.2-1+deb10u1, 1.24.1-1+deb11u1, 1.26.0-1+deb12u2, 1.26.2-1
  Version impact unknown
  dsa · engrampa · debian · bookworm; pypi · engrampa · debian · 12; pypi · engrampa · debian · 13; pypi · engrampa · debian · 14; pypi · engrampa · debian · 11; pypi · engrampa · debian · 10
- 1.26.2-5 · all · trixie
  Inconnu · Corrigée: 1.20.2-1+deb10u1, 1.24.1-1+deb11u1, 1.26.0-1+deb12u2, 1.26.2-1
  Version impact unknown
  dsa · engrampa · debian · bookworm; pypi · engrampa · debian · 12; pypi · engrampa · debian · 13; pypi · engrampa · debian · 14; pypi · engrampa · debian · 11; pypi · engrampa · debian · 10

Observé: Oct 29, 2026, 10:50:49 PM UTC

Références

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]