Collected research

When URL parsers disagree (CVE-2023-38633)

Zac Sims · 5 September 2023

Analyzes a librsvg file-read vulnerability caused by disagreement between Rust's URL parser and Gio's URI handling. A crafted file URL passes validation but is interpreted as a traversing local path when the SVG processor resolves external XML content.

Record

Researcher

Zac Sims

Date

5 September 2023

In the archive

• Collected in the 2023 research round

Tags

• url-parsing
• parser-differential
• file-read
• path-traversal
• xml
• cve
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of Zac Sims, first published at the original source. Preserved copies are kept so the citation survives its host.