cve/2023/CVE-2023-50254.md

### [CVE-2023-50254](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-50254)
![](https://img.shields.io/static/v1?label=Product&message=developer-center&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20%3C%206.0.7%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-22%3A%20Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-27%3A%20Path%20Traversal%3A%20'dir%2F..%2F..%2Ffilename'&color=brighgreen)

### Description

Deepin Linux's default document reader `deepin-reader` software suffers from a serious vulnerability in versions prior to 6.0.7 due to a design flaw that leads to remote command execution via crafted docx document. This is a file overwrite vulnerability. Remote code execution (RCE) can be achieved by overwriting files like .bash_rc, .bash_login, etc. RCE will be triggered when the user opens the terminal. Version 6.0.7 contains a patch for the issue.

### POC

#### Reference
- https://github.com/linuxdeepin/developer-center/security/advisories/GHSA-q9jr-726g-9495

#### Github
- https://github.com/febinrev/deepin-linux_reader_RCE-exploit
- https://github.com/nomi-sec/PoC-in-GitHub