Description
The CVS 1.10.8 client trusts pathnames that are provided by the CVS server, which allows the server to force the client to create arbitrary files.
Exploits (1)
exploitdb
WORKING POC
VERIFIED
by Tanaka Akira · textlocalunix
https://www.exploit-db.com/exploits/20107
References (2)
Core 2
Core References
Exploit, Vendor Advisory mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/frames/?content=/templates/archive.pike%3Flist%3D1%26msg%3Dhvou2daoebb.fsf%40serein.m17n.org
Exploit, Vendor Advisory vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/1523
Scores
EPSS
0.0094
EPSS Percentile
76.4%
Details
Status
published
Products (1)
cvs/cvs
1.10.8
Published
Oct 20, 2000
Tracked Since
Feb 18, 2026