Name: CVE-2016-7116: Improper Limitation of a Pathname to a Restricted Directory
Creator: Rapid7
Published: 2016-12-10T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2016-7116, CWE-22, CVSS 6, EPSS 0.00627

Directory traversal vulnerability in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to access host files outside the export path via a .. (dot dot) in an unspecified string.

CVSS Details

CVSS 3.1 Base Score: 6
CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Debian	—	Upgrade qemuUpgrade qemu-kvm	Mar 31, 2017	Sep 11, 2016
Gentoo Linux	—	Upgrade app-emulation/qemu.	Oct 30, 2017	Dec 9, 2016
Huawei Euleros 2_0_sp2	—	Upgrade qemu-kvmUpgrade qemu-kvm-commonUpgrade qemu-img	Dec 4, 2019	Dec 10, 2016
Huawei Euleros 2_0_sp3	—	Upgrade qemu-imgUpgrade qemu-kvm-commonUpgrade qemu-kvm	Apr 16, 2020	Dec 10, 2016
Redhat_linux	—	No solution exists	Jul 9, 2025	Aug 11, 2016
Suse	—	Upgrade qemu-s390Upgrade qemu-ui-gtkUpgrade qemu-guest-agentUpgrade qemu-microvmUpgrade qemu-ppcUpgrade qemu-s390xUpgrade qemu-audio-ossUpgrade qemu-audio-paUpgrade qemu-block-sshUpgrade qemu-hw-usb-redirectUpgrade qemu-skibootUpgrade qemu-langUpgrade qemu-block-iscsiUpgrade qemu-audio-alsaUpgrade qemu-ui-spice-appUpgrade qemu-chardev-baumUpgrade qemu-block-rbdUpgrade qemu-ksmUpgrade qemu-chardev-spiceUpgrade qemu-audio-spiceUpgrade qemu-ipxeUpgrade qemu-seabiosUpgrade qemu-ui-openglUpgrade qemu-block-curlUpgrade qemu-ui-spice-coreUpgrade qemu-x86Upgrade qemu-kvmUpgrade qemu-vgabiosUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemuUpgrade kvmUpgrade qemu-sgabiosUpgrade qemu-armUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-hw-display-qxlUpgrade qemu-toolsUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-ui-cursesUpgrade qemu-hw-display-virtio-vga	Nov 3, 2016	Oct 21, 2016
Ubuntu	—	Upgrade qemu-system-miscUpgrade qemu-system-x86Upgrade qemu-system-aarch64Upgrade qemu-system-ppcUpgrade qemu-systemUpgrade qemu-system-mipsUpgrade qemu-system-sparcUpgrade qemu-system-s390xUpgrade qemu-system-armUpgrade qemu-kvm	Nov 9, 2016	Nov 9, 2016

Prioritise with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritise with Active Threat Intelligence