diff --git a/backport-CVE-2021-38291.patch b/backport-CVE-2021-38291.patch
new file mode 100644
index 0000000000000000000000000000000000000000..261af4c2ab481d971bd187683a00b809b9b0b864
--- /dev/null
+++ b/backport-CVE-2021-38291.patch
@@ -0,0 +1,28 @@
+From 1e4c9948024c3b991e646f730a90aa58415cad8f Mon Sep 17 00:00:00 2001
+From: root <root@localhost.localdomain>
+Date: Fri, 6 Sep 2024 18:19:43 +0800
+Subject: [PATCH] CVE-2023-50255
+
+---
+ 3rdparty/libzipplugin/libzipplugin.cpp | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/3rdparty/libzipplugin/libzipplugin.cpp b/3rdparty/libzipplugin/libzipplugin.cpp
+index bb342f5..f137f32 100644
+--- a/3rdparty/libzipplugin/libzipplugin.cpp
++++ b/3rdparty/libzipplugin/libzipplugin.cpp
+@@ -677,6 +677,11 @@ ErrorType LibzipPlugin::extractEntry(zip_t *archive, zip_int64_t index, const Ex
+ 
+     strFileName = m_common->trans2uft8(statBuffer.name, m_mapFileCode[index]);    // 解压文件名（压缩包中）
+     // 提取
++    //fix 232873
++    if(strFileName.indexOf("../") != -1) {
++        qInfo() << "skipped ../ path component(s) in " << strFileName;
++        strFileName = strFileName.replace("../", "");
++    }
+     if (!options.strDestination.isEmpty()) {
+         strFileName = strFileName.remove(0, options.strDestination.size());
+     }
+-- 
+2.39.3
+
diff --git a/deepin-compressor.spec b/deepin-compressor.spec
index 756c5c1acab80119521cf14c814c70aa3eb2c2d0..ecfd5be18c72f114b6cca739c007a210a93888f4 100644
--- a/deepin-compressor.spec
+++ b/deepin-compressor.spec
@@ -1,4 +1,4 @@
-%define specrelease 3
+%define specrelease 4
 
 Name:           deepin-compressor
 Version:        5.10.5
@@ -8,6 +8,7 @@ License:        GPLv3+
 URL:            https://github.com/linuxdeepin/deepin-devicemanager
 Source0:        %{name}-%{version}.tar.gz
 Patch0:         0001-feat-enable-debuginfo.patch
+Patch1:         backport-CVE-2021-38291.patch
 
 BuildRequires: gcc-c++
 BuildRequires: cmake
@@ -91,6 +92,9 @@ echo "%{_libdir}/%{name}/plugins/" > %{buildroot}/%{_sysconfdir}/ld.so.conf.d/%{
 /sbin/ldconfig
 
 %changelog
+* Fri Sep 06 2024 pangqing <pangqing@uniontech.com> - 5.10.5-4
+- CVE-2021-38291 
+
 * Tue Mar 14 2023 liweigang <liweiganga@uniontech.com> - 5.10.5-3
 - feat: remove rpath