Path Traversal in Squashfs-Tools Project
CVE-2021-40153
squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations outside of the destination.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.025 (83.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H.
Affected products
- Squashfs-tools_project Squashfs-tools — versions 4.5
- Debian Debian_linux — versions 9.0, 10.0
- Fedoraproject Fedora — versions 34, 33
- Redhat Enterprise_linux — versions 7.0, 8.0
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Patch, Third Party Advisory)
- cve@mitre.org (Exploit, Third Party Advisory)
- cve@mitre.org (Third Party Advisory)
- cve@mitre.org (vendor-advisory)
- cve@mitre.org (mailing-list, Mailing List, Third Party Advisory)
- cve@mitre.org (vendor-advisory, Third Party Advisory)
- cve@mitre.org (vendor-advisory)
- cve@mitre.org (vendor-advisory)
Frequently asked questions
- What is CVE-2021-40153?
- CVE-2021-40153 is a high-severity vulnerability in Squashfs-Tools Project, classified under Path Traversal. CVSS score: 8.1/10. Published 2021-08-27.
- How severe is CVE-2021-40153?
- High severity. CVSS v3 base score is 8.1 out of 10.
- Is CVE-2021-40153 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.