CVE-2023-52953 is a medium severity path traversal flaw (CVSS 6.2) in the Medialibrary module of Huawei HarmonyOS and EMUI. Huawei listed it in its January 2025 security bulletin. Install the January 2025 security update or any later one, and check the bulletin for your device.
What's affected
Huawei's January 2025 bulletin lists CVE-2023-52953 as a path traversal vulnerability in the Medialibrary module, with severity Medium, affecting HarmonyOS 3.0.0, 2.0.0 and 2.1.0, and EMUI 13.0.0 and 12.0.0. The bulletin says successful exploitation will affect integrity and confidentiality.
The vector in the record is local, with no privileges and no user action needed, and rates the impact on availability as high. That differs from the bulletin's wording, so read both and treat the NVD vector as the source for the score. The bulletin does not list a fixed software version for this entry, so use the monthly security update as the fix.
How to check if you're exposed
On a Huawei phone or tablet, open Settings, then About, and read the version, then check the system update page for the security patch level. Compare against the bulletin month. A device that has installed the January 2025 update or later includes the patches listed in that bulletin.
For fleets, use your mobile device management console to list the OS version and patch level and filter for HarmonyOS 2.x, 3.0 and EMUI 12 and 13.
The record sets the attack vector as local, so a malicious app or local access would be the likely route. Review which apps people can install on managed devices.
What to do now
- List Huawei devices, their operating system version and patch level.
- Install the January 2025 security update or any later update through the device's system update page.
- Flag devices that no longer receive updates, and decide what data they may hold.
- Limit app installs to approved stores on managed devices.
Why it matters
Path traversal (CWE-22) is a failure to restrict a file path to the folder it should stay in. A program that builds a path from input without cleaning it can be steered to files outside the intended location. In a media library module, that could mean reading or changing files that belong to other components.
The score of 6.2 reflects a local attack vector with low complexity and no required privileges, and the vector in the record carries a high availability impact. For most organisations the answer is routine patching and sensible app policy. The CVE is not on the CISA Known Exploited Vulnerabilities list, and nothing fetched for this post says it is exploited.
Quick check
Which update fixes it?
The January 2025 Huawei security update or later, since the bulletin does not list a separate fixed version for this entry.
Can it be attacked from the internet?
The record sets the attack vector as local, so it needs access on the device.
Sources
Last reviewed: 19 October 2026.
