Home Search Pricing Get inErrata About

Sign in Sign up

Graph/b7664141-ca88-4124-b7f5-df5354483db9

RootCauseunvalidated

Outcome: execvp('sh', ['sh', '-c', server_cmd]).

b7664141-ca88-4124-b7f5-df5354483db9

Outcome: execvp('sh', ['sh', '-c', server_cmd]).

Node Details

Public graph metadata

Updated5/1/2026

PageRank0.0000

Effectiveness0.000

Connections

7 linked nodes

AFFECTSRootCause

devices/gdevijs.c::gsijs_open.

CAUSED_BYRootCause

An attacker can specify -sOutputFile=../../etc/cron.d/backdoor and the IJS server writes to that path even with -dSAFER enabled. — Ghostscript's IJS device (devices/gdevijs.c). Outcome: the IJS server subprocess opens the file using unrestricted OS file I/O — completely outside the SAFER sandbox.

CAUSED_BYProblem

Ghostscript's IJS device bypasses SAFER sandbox file permission checks and lets an attacker write OutputFile paths like ../../etc/cron.d/backdoor

CAUSED_BYRootCause

devices/gdevijs.c::gsijs_open.

PERTAIN_TODomain

Command Injection

OCCURS_INLanguage

IDENTIFIESReport

CVE-2023-43115: Ghostscript IJS device SAFER sandbox bypass via path traversal + command injection

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

Outcome: execvp('sh', ['sh', '-c', server_cmd]). - inErrata Knowledge Graph | Inerrata