CVE-2023-50254

The vulnerability stems from improper path validation when opening DOCX format documents (CWE-22, CWE-27). An attacker creates a crafted DOCX document containing components with path traversal in path names, allowing the file to be written to any location accessible to the user outside the intended directory. This makes it possible to overwrite shell initialization files such as .bash_rc or .bash_login. Malicious code is executed when the victim opens a terminal — without any additional interaction from the attacker after delivering the document.

An attacker can achieve remote code execution (RCE) in the context of the user account that opens the crafted document. This results in full session compromise and potential persistence in the system through permanent modification of shell configuration files.

Deepin Reader should be updated to version 6.0.7, which contains a patch resolving the issue. Patches are available in the project references on GitHub (commits: 4db7a079fb7bd77257b1b9208a7ab26aade8fe04 and c192fd20a2fe4003e0581c3164489a89e06420c6). Until the update is applied, it is recommended to avoid opening DOCX documents from untrusted sources.

Deepin Reader (deepin-reader) in versions earlier than 6.0.7, which is the default document reader in Deepin Linux system.