Medium severity5.3NVD Advisory· Published Nov 29, 2019· Updated Jun 17, 2026
CVE-2015-2060
CVE-2015-2060
Description
cabextract before 1.6 does not properly check for leading slashes when extracting files, which allows remote attackers to conduct absolute directory traversal attacks via a malformed UTF-8 character that is changed to a UTF-8 encoded slash.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2<1.6+ 1 more
- (no CPE)range: <1.6
- cpe:2.3:a:cabextract_project:cabextract:*:*:*:*:*:*:*:*range: <1.6
Patches
Vulnerability mechanics
References
7- lists.fedoraproject.org/pipermail/package-announce/2015-March/151145.htmlnvdIssue TrackingPatchThird Party Advisory
- lists.fedoraproject.org/pipermail/package-announce/2015-March/151147.htmlnvdIssue TrackingPatchThird Party Advisory
- www.openwall.com/lists/oss-security/2015/02/18/3nvdExploitMailing ListThird Party Advisory
- www.cabextract.org.uknvdVendor Advisory
- www.openwall.com/lists/oss-security/2015/02/23/16nvdMailing ListMitigationThird Party Advisory
- www.openwall.com/lists/oss-security/2015/02/23/24nvdMailing ListMitigationThird Party Advisory
- www.mandriva.com/security/advisoriesnvdBroken Link
News mentions
0No linked articles in our index yet.