CVE-2023-31131

Greenplum Database (GPDB) is an open source data warehouse based on PostgreSQL. In versions prior to 6.22.3 Greenplum Database used an unsafe methods to extract tar files within GPPKGs. greenplum-db is vulnerable to path traversal leading to arbitrary file writes. An attacker can use this vulnerability to overwrite data or system files potentially leading to crash or malfunction of the system. Any files which are accessible to the running process are at risk. All users are requested to upgrade to Greenplum Database version 6.23.2 or higher. There are no known workarounds for this vulnerability.

• CWE-22

• https://github.com/greenplum-db/gpdb/commit/1ec4affbba7c9745f64edbd80a6680ad29b09471Patch
• https://github.com/greenplum-db/gpdb/security/advisories/GHSA-hgm9-2q42-c7f3Vendor Advisory
• https://github.com/greenplum-db/gpdb/commit/1ec4affbba7c9745f64edbd80a6680ad29b09471Patch
• https://github.com/greenplum-db/gpdb/security/advisories/GHSA-hgm9-2q42-c7f3Vendor Advisory

Published

May 15, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-31126`org.xwiki.commons:xwiki-commons-xml` is an XML library used…9.6
• CVE-2023-31127libspdm is a sample implementation that follows the DMTF SPD…8.8
• CVE-2023-31128NextCloud Cookbook is a recipe library app. Prior to commit …8.8
• CVE-2023-31129The Contiki-NG operating system versions 4.8 and prior can b…9.8
• CVE-2023-3113An unauthenticated XML external entity injection (XXE) vulne…7.5
• CVE-2023-31130c-ares is an asynchronous resolver library. ares_inet_net_pt…6.4
• CVE-2023-31132Cacti is an open source operational monitoring and fault man…7.8
• CVE-2023-31133Ghost is an app for new-media creators with tools to build a…7.5
• CVE-2023-31134Tauri is software for building applications for multi-platfo…5.4
• CVE-2023-31135Dgraph is an open source distributed GraphQL database. Exist…5.5
• CVE-2023-31136PostgresNIO is a Swift client for PostgreSQL. Any user of Po…5.9
• CVE-2023-31137MaraDNS is open-source software that implements the Domain N…7.5