cabextract before 1.6 does not properly check for leading slashes when extracting files, which allows remote attackers to conduct absolute directory traversal attacks via a malformed UTF-8 character that is changed to a UTF-8 encoded slash.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade cabextract | Aug 30, 2017 | Apr 27, 2015 |
| Debian | — | Upgrade cabextract | Jul 30, 2024 | Nov 29, 2019 |
| Freebsd | — | Upgrade cabextract | Dec 10, 2025 | May 31, 2015 |
| Ubuntu | — | Upgrade cabextract (Ubuntu Pro) | Nov 19, 2024 | Nov 29, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub