CVE-2022-4883 Command injection in libXpm

High 8.8 Published 7 Feb 2023 Updated 20 Mar 2025

Attackers can execute arbitrary code by manipulating the PATH environment variable when libXpm processes compressed image files.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-4883?

CVE-2022-4883 is a high-severity command injection vulnerability in libXpm, published on 7 Feb 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to compress and uncompress files, relying on the PATH environment variable to find these programs, which could allow a malicious user to execute other programs by manipulating the PATH environment variable.

Weakness: CWE-426

Which versions are affected by CVE-2022-4883?

It affects 1 product.

Linux distribution packages (11)

`libXpm` Red Hat:enterprise_linux:7::client	All versions	`0:3.5.12-2.el7_9`
`libXpm-debuginfo` Red Hat:enterprise_linux:7::client	All versions	`0:3.5.12-2.el7_9`
`libXpm-devel` Red Hat:enterprise_linux:7::client	All versions	`0:3.5.12-2.el7_9`
`libXpm-debuginfo` Red Hat:enterprise_linux:7::computenode	All versions	`0:3.5.12-2.el7_9`
`libXpm-devel` Red Hat:enterprise_linux:7::computenode	All versions	`0:3.5.12-2.el7_9`
`libXpm` Red Hat:enterprise_linux:7::server	All versions	`0:3.5.12-2.el7_9`
`libXpm-debuginfo` Red Hat:enterprise_linux:7::server	All versions	`0:3.5.12-2.el7_9`
`libXpm-devel` Red Hat:enterprise_linux:7::server	All versions	`0:3.5.12-2.el7_9`
`libXpm` Red Hat:enterprise_linux:7::workstation	All versions	`0:3.5.12-2.el7_9`
`libXpm-debuginfo` Red Hat:enterprise_linux:7::workstation	All versions	`0:3.5.12-2.el7_9`
`libXpm-devel` Red Hat:enterprise_linux:7::workstation	All versions	`0:3.5.12-2.el7_9`

Products include X.org Libxpm.

How do I fix CVE-2022-4883?

Apply the vendor's patch.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2022-4883 being exploited?

There is no known exploitation of CVE-2022-4883 in the wild and no public exploit code.

Sources

Also known as ALPINE-CVE-2022-4883, AZL-13248, DEBIAN-CVE-2022-4883, GHSA-75px-q76w-83rc, JLSEC-2026-285, RHSA-2023:0377 and 1 more.