TI-2015-01847 Aliases CVE-2015-2060 GHSA-frjv-h9wg-233r

cabextract before 1.6 does not properly check for leading slashes when extracting files…

LOW 28CWE-22Published 2019-11-29 · Updated 2024-08-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

cabextract before 1.6 does not properly check for leading slashes when extracting files, which allows remote attackers to conduct absolute directory traversal attacks via a malformed UTF-8 character that is changed to a UTF-8 encoded slash.

Why it matters now

EPSS 0.02308 83rd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:cabextract_project:cabextract::::::::	before 1.6	Vulnerable	Cabextract Project
cpe:2.3:o:linux:linux_kernel:-:::::::*	not specified by NVD	Running on	Linux

cpe:2.3:a:cabextract_project:cabextract:*:*:*:*:*:*:*:* Versions before 1.6 Vulnerable ·Cabextract Project
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2015-2060
2026-10-03 Alias added: GHSA-frjv-h9wg-233r

References

Exploit 1

http://www.openwall.com/lists/oss-security/2015/02/18/3

Patch 2

Advisory 3

Other 1

http://www.mandriva.com/security/advisories?name=MDVSA-2015:064

TI-2018-10539 An issue was discovered in kwajd_read_headers in mspack/kwajd.c in libmspack before… CVSS 3.0HIGH 8.8
TI-2018-10540 An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. CVSS 3.0HIGH 8.8
TI-2018-10538 An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. CVSS 3.0MEDIUM 6.5
TI-2018-10537 An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. CVSS 3.0MEDIUM 6.5
TI-2018-13144 In mspack/cab.h in libmspack before 0.8alpha and cabextract before 1.8, the CAB block… CVSS 3.1MEDIUM 6.5
TI-2010-02678 Integer signedness error in the Quantum decompressor in cabextract before 1.3, when… CVSS 2.0MEDIUM 5.1

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences