CVE-2023-38745

published 2023-07-25

CVE-2023-38745: Pandoc before 3.1.6 allows arbitrary file write: this can be triggered by providing a crafted image element in the input when generating files via the…

Priority P4 30 medium 6.3 CVSS 3.1

AV L AC H PR N UI R S U C N I H A H

Pandoc before 3.1.6 allows arbitrary file write: this can be triggered by providing a crafted image element in the input when generating files via the --extract-media option or outputting to PDF format. This allows an attacker to create or overwrite arbitrary files, depending on the privileges of the process running Pandoc. It only affects systems that pass untrusted user input to Pandoc and allow Pandoc to be used to produce a PDF or with the --extract-media option. NOTE: this issue exists because of an incomplete fix for CVE-2023-35936 (failure to properly account for double encoded path names).

Affected

3 ranges

Vendor	Product	Version range	Fixed in
debian	debian_linux	—	—
debian	pandoc	—	—
pandoc	pandoc	< 3.1.6	3.1.6

CVSS provenance

nvd v3.1 6.3 MEDIUM CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H

osv 5.0 MEDIUM

vendor_debian 6.1 LOW

vendor_redhat 6.1 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-20