CVE-2023-26321

A path traversal vulnerability exists in the Xiaomi File Manager application product(international version). The vulnerability is caused by unfiltered special characters and can be exploited by attackers to overwrite and execute code in the file.

CVSS v3 6.3 MEDIUM

6.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.4 / Impact : 5.9

Attack Vector PHYSICAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://trust.mi.com/misrc/bulletins/advisory?cveId=541	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mi:file_manager:1-210567:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-08-28 08:15

Updated : 2025-03-25 16:15

NVD link : CVE-2023-26321

Mitre link : CVE-2023-26321

CVE.ORG link : CVE-2023-26321

JSON object : View

Products Affected

mi

file_manager

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2023-26321", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@xiaomi.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.4}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2024-08-28T08:15:06.083", "references": [{"url": "https://trust.mi.com/misrc/bulletins/advisory?cveId=541", "tags": ["Vendor Advisory"], "source": "security@xiaomi.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "A path traversal vulnerability exists in the Xiaomi File Manager application product(international version). The vulnerability is caused by unfiltered special characters and can be exploited by attackers to overwrite and execute code in the file."}, {"lang": "es", "value": "Existe una vulnerabilidad de path traversal en el producto de la aplicaci\u00f3n Xiaomi File Manager (versi\u00f3n internacional). La vulnerabilidad es causada por caracteres especiales sin filtrar y los atacantes pueden aprovecharla para sobrescribir y ejecutar c\u00f3digo en el archivo."}], "lastModified": "2025-03-25T16:15:16.857", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mi:file_manager:1-210567:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8010BDED-A28F-468D-A92C-3D2FAF09D29A"}], "operator": "OR"}]}], "sourceIdentifier": "security@xiaomi.com"}