CVE-2023-32454 Path traversal in DUP Framework
A local attacker can exploit Windows junction handling to create arbitrary files, causing denial of service in Dell DUP Framework.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-32454?
CVE-2023-32454 is a medium-severity path traversal vulnerability in Dell DUP Framework , published on 6 Feb 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
DUP framework version 4.9.4.36 and prior contains insecure operation on Windows junction/Mount point vulnerability. A local malicious standard user could exploit the vulnerability to create arbitrary files, leading to denial of service
Which versions are affected by CVE-2023-32454?
It affects 1 product.
Products include Dell Update Package Framework.
How do I fix CVE-2023-32454?
No fix has been published for CVE-2023-32454 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-32454 being exploited?
There is no known exploitation of CVE-2023-32454 in the wild and no public exploit code.
Other vulnerabilities in Dell DUP Framework
- CVE-2026-71180 Privilege escalation in Update Package Framework
- CVE-2026-23857 Privilege escalation in Update Package
- CVE-2025-22395 Privilege escalation in Dell Update Package (DUP) Framework
- CVE-2026-71179 Command injection in Update Package Framework
- CVE-2023-39254 Path traversal in DUP Framework
Sources
Also known as GHSA-934w-fhc8-qwcj.