CVE-2010-2104
Orbit Downloader 3.0.0.4 and 3.0.0.5 - Path Traversal and Arbitrary File Write via Metalink File Element
Title source: llmDescription
Directory traversal vulnerability in Orbit Downloader 3.0.0.4 and 3.0.0.5 allows user-assisted remote attackers to write arbitrary files via a metalink file containing directory traversal sequences in the name attribute of a file element.
References (3)
Core 3
Core References
Vendor Advisory x_refsource_misc
http://secunia.com/secunia_research/2010-73/
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/39527
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/511348/100/100/threaded
Scores
EPSS
0.0296
EPSS Percentile
85.5%
Details
CWE
CWE-22
Status
published
Products (2)
orbitdownloader/orbit_downloader
3.0.0.4
orbitdownloader/orbit_downloader
3.0.0.5
Published
May 27, 2010
Tracked Since
Feb 18, 2026