CVE-2023-52138
It was discovered that Engrampa incorrectly handled symbolic links when extracting certain archives. An attacker could possibly use this issue to write arbitrary files and execute arbitrary code.
CSIRTS triage
- What
- Engrampa incorrectly handles symbolic links during archive extraction, allowing arbitrary file writes and code execution.
- Who is affected
- Users extracting untrusted archives with Engrampa are affected.
- Urgency
- Moderate priority; no active exploitation confirmed but arbitrary code execution is possible.
- Action
- Upgrade Engrampa to a patched version that properly validates symbolic links.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2023-52138
Get an email if CVE-2023-52138 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Moderate exploitation risk1.7% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 74% of all EPSS-scored CVEs.
Advisory coverage (1)
- unknownUSN-8640-1: Engrampa vulnerabilityubuntu · 2026-08-17
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2023-52138)