CVE-2015-2060

cabextract before 1.6 does not properly check for leading slashes when extracting files, which allows remote attackers to conduct absolute directory traversal…

published November 29, 2019

CVSS
—
EPSS
2%
Percentile
83.2
In the wild
Unconfirmed
What it is

cabextract before 1.6 does not properly check for leading slashes when extracting files, which allows remote attackers to conduct absolute directory traversal attacks via a malformed UTF-8 character that is changed to a UTF-8 encoded slash.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02308 · 83.2th percentile
Published
2019-11-29T20:55Z
EPSS history
Timeline
  • 29 NOV 20:55Z
    cabextract before 1.6 does not properly check for leading slashes when extracting files, which allows remote attackers to conduct absolute directory traversal…
    cvelistv5