CVE-2019-13241

HIGH

FlightCrew < 0.9.2 - Path Traversal and Arbitrary File Write via ZIP Archive Extraction

Title source: llm
STIX 2.1

Description

FlightCrew v0.9.2 and older are vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive entry that is mishandled during extraction.

References (3)

Core 3
Core References
Exploit, Third Party Advisory x_refsource_misc
https://github.com/Sigil-Ebook/flightcrew/issues/52
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/4055-1/

Scores

CVSS v3 7.8
EPSS 0.0041
EPSS Percentile 61.5%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-22
Status published
Products (5)
canonical/ubuntu_linux 16.04
canonical/ubuntu_linux 18.04
canonical/ubuntu_linux 18.10
canonical/ubuntu_linux 19.04
flightcrew_project/flightcrew < 0.9.2
Published Jul 04, 2019
Tracked Since Feb 18, 2026