CVE-2015-1197 - Vulnerability Details - OpenCVE

cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Local

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Gnu	Cpio

Configuration 1 [-]

cpe:2.3:a:gnu:cpio:2.11:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://advisories.mageia.org/MGASA-2015-0080.html
http://packetstormsecurity.com/files/169458/Zimbra-Collaboration-Suite-TAR-Path-Traversal.html
http://www.mandriva.com/security/advisories?name=MDVSA-2015:066
http://www.openwall.com/lists/oss-security/2015/01/07/5
http://www.openwall.com/lists/oss-security/2015/01/18/7
http://www.openwall.com/lists/oss-security/2023/12/21/8
http://www.openwall.com/lists/oss-security/2023/12/27/1
http://www.securityfocus.com/bid/71914
http://www.ubuntu.com/usn/USN-2906-1
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774669
https://lists.gnu.org/archive/html/bug-cpio/2015-01/msg00000.html
https://nvd.nist.gov/vuln/detail/CVE-2015-1197
https://www.cve.org/CVERecord?id=CVE-2015-1197

History

Wed, 14 Oct 2026 22:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2015-02-19T00:00:00.000Z

Updated: 2026-10-14T21:10:58.785Z

Reserved: 2015-01-18T00:00:00.000Z

Link: CVE-2015-1197

Vulnrichment

Updated: 2024-08-06T04:33:20.813Z

NVD

Status : Modified

Published: 2015-02-19T15:59:12.377

Modified: 2026-10-14T22:17:03.540

Link: CVE-2015-1197

Redhat

Severity : Low

Publid Date: 2015-01-05T00:00:00Z

Links: CVE-2015-1197 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2015-1197", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-10-14T21:10:58.785Z", "dateReserved": "2015-01-18T00:00:00.000Z", "datePublished": "2015-02-19T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2023-12-27T15:06:17.838Z"}, "descriptions": [{"lang": "en", "value": "cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"name": "71914", "tags": ["vdb-entry"], "url": "http://www.securityfocus.com/bid/71914"}, {"name": "MDVSA-2015:066", "tags": ["vendor-advisory"], "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:066"}, {"name": "[oss-security] 20150118 Re: CVE Request: cpio -- directory traversal", "tags": ["mailing-list"], "url": "http://www.openwall.com/lists/oss-security/2015/01/18/7"}, {"name": "USN-2906-1", "tags": ["vendor-advisory"], "url": "http://www.ubuntu.com/usn/USN-2906-1"}, {"url": "http://advisories.mageia.org/MGASA-2015-0080.html"}, {"name": "[oss-security] 20150108 Directory traversals in cpio and friends?", "tags": ["mailing-list"], "url": "http://www.openwall.com/lists/oss-security/2015/01/07/5"}, {"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774669"}, {"name": "[Bug-cpio] 20150108 cpio: directory traversal vulnerability via symlinks", "tags": ["mailing-list"], "url": "https://lists.gnu.org/archive/html/bug-cpio/2015-01/msg00000.html"}, {"url": "http://packetstormsecurity.com/files/169458/Zimbra-Collaboration-Suite-TAR-Path-Traversal.html"}, {"name": "[oss-security] 20231221 Security vulnerability in Debian's cpio 2.13", "tags": ["mailing-list"], "url": "http://www.openwall.com/lists/oss-security/2023/12/21/8"}, {"name": "[oss-security] 20231227 xarchiver: Path traversal with crafted cpio archives", "tags": ["mailing-list"], "url": "http://www.openwall.com/lists/oss-security/2023/12/27/1"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}], "datePublic": "2015-01-06T00:00:00.000Z"}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T04:33:20.813Z"}, "title": "CVE Program Container", "references": [{"name": "71914", "tags": ["vdb-entry", "x_transferred"], "url": "http://www.securityfocus.com/bid/71914"}, {"name": "MDVSA-2015:066", "tags": ["vendor-advisory", "x_transferred"], "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:066"}, {"name": "[oss-security] 20150118 Re: CVE Request: cpio -- directory traversal", "tags": ["mailing-list", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2015/01/18/7"}, {"name": "USN-2906-1", "tags": ["vendor-advisory", "x_transferred"], "url": "http://www.ubuntu.com/usn/USN-2906-1"}, {"url": "http://advisories.mageia.org/MGASA-2015-0080.html", "tags": ["x_transferred"]}, {"name": "[oss-security] 20150108 Directory traversals in cpio and friends?", "tags": ["mailing-list", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2015/01/07/5"}, {"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774669", "tags": ["x_transferred"]}, {"name": "[Bug-cpio] 20150108 cpio: directory traversal vulnerability via symlinks", "tags": ["mailing-list", "x_transferred"], "url": "https://lists.gnu.org/archive/html/bug-cpio/2015-01/msg00000.html"}, {"url": "http://packetstormsecurity.com/files/169458/Zimbra-Collaboration-Suite-TAR-Path-Traversal.html", "tags": ["x_transferred"]}, {"name": "[oss-security] 20231221 Security vulnerability in Debian's cpio 2.13", "tags": ["mailing-list", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2023/12/21/8"}, {"name": "[oss-security] 20231227 xarchiver: Path traversal with crafted cpio archives", "tags": ["mailing-list", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2023/12/27/1"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-01-16T16:20:26.842265Z", "id": "CVE-2015-1197", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-14T21:10:58.785Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.securityfocus.com/bid/71914", "name": "71914", "tags": ["vdb-entry", "x_transferred"]}, {"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:066", "name": "MDVSA-2015:066", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2015/01/18/7", "name": "[oss-security] 20150118 Re: CVE Request: cpio -- directory traversal", "tags": ["mailing-list", "x_transferred"]}, {"url": "http://www.ubuntu.com/usn/USN-2906-1", "name": "USN-2906-1", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "http://advisories.mageia.org/MGASA-2015-0080.html", "tags": ["x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2015/01/07/5", "name": "[oss-security] 20150108 Directory traversals in cpio and friends?", "tags": ["mailing-list", "x_transferred"]}, {"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774669", "tags": ["x_transferred"]}, {"url": "https://lists.gnu.org/archive/html/bug-cpio/2015-01/msg00000.html", "name": "[Bug-cpio] 20150108 cpio: directory traversal vulnerability via symlinks", "tags": ["mailing-list", "x_transferred"]}, {"url": "http://packetstormsecurity.com/files/169458/Zimbra-Collaboration-Suite-TAR-Path-Traversal.html", "tags": ["x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2023/12/21/8", "name": "[oss-security] 20231221 Security vulnerability in Debian's cpio 2.13", "tags": ["mailing-list", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2023/12/27/1", "name": "[oss-security] 20231227 xarchiver: Path traversal with crafted cpio archives", "tags": ["mailing-list", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T04:33:20.813Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2015-1197", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-01-16T16:20:26.842265Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-14T21:10:53.513Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2015-01-06T00:00:00.000Z", "references": [{"url": "http://www.securityfocus.com/bid/71914", "name": "71914", "tags": ["vdb-entry"]}, {"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:066", "name": "MDVSA-2015:066", "tags": ["vendor-advisory"]}, {"url": "http://www.openwall.com/lists/oss-security/2015/01/18/7", "name": "[oss-security] 20150118 Re: CVE Request: cpio -- directory traversal", "tags": ["mailing-list"]}, {"url": "http://www.ubuntu.com/usn/USN-2906-1", "name": "USN-2906-1", "tags": ["vendor-advisory"]}, {"url": "http://advisories.mageia.org/MGASA-2015-0080.html"}, {"url": "http://www.openwall.com/lists/oss-security/2015/01/07/5", "name": "[oss-security] 20150108 Directory traversals in cpio and friends?", "tags": ["mailing-list"]}, {"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774669"}, {"url": "https://lists.gnu.org/archive/html/bug-cpio/2015-01/msg00000.html", "name": "[Bug-cpio] 20150108 cpio: directory traversal vulnerability via symlinks", "tags": ["mailing-list"]}, {"url": "http://packetstormsecurity.com/files/169458/Zimbra-Collaboration-Suite-TAR-Path-Traversal.html"}, {"url": "http://www.openwall.com/lists/oss-security/2023/12/21/8", "name": "[oss-security] 20231221 Security vulnerability in Debian's cpio 2.13", "tags": ["mailing-list"]}, {"url": "http://www.openwall.com/lists/oss-security/2023/12/27/1", "name": "[oss-security] 20231227 xarchiver: Path traversal with crafted cpio archives", "tags": ["mailing-list"]}], "descriptions": [{"lang": "en", "value": "cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2023-12-27T15:06:17.838Z"}}}, "cveMetadata": {"cveId": "CVE-2015-1197", "state": "PUBLISHED", "dateUpdated": "2026-10-14T21:10:58.785Z", "dateReserved": "2015-01-18T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2015-02-19T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gnu:cpio:2.11:*:*:*:*:*:*:*", "matchCriteriaId": "D68C6D55-2BC4-4F00-B5EF-203DE849AD60", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive."}, {"lang": "es", "value": "cpio 2.11, cuando utiliza la opci\u00f3n --no-absolute-filenames, permite a usuarios locales escribir ficheros arbitrarios a trav\u00e9s de un ataque de enlace simb\u00f3lico sobre un fichero en un archivo."}], "evaluatorComment": "<a href=\"http://cwe.mitre.org/data/definitions/61.html\">CWE-61: UNIX Symbolic Link (Symlink) Following</a>", "id": "CVE-2015-1197", "lastModified": "2026-10-14T22:17:03.540", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 1.9, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 3.4, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2015-1197", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-01-16T16:20:26.842265Z", "version": "2.0.3"}}]}, "published": "2015-02-19T15:59:12.377", "references": [{"source": "cve@mitre.org", "url": "http://advisories.mageia.org/MGASA-2015-0080.html"}, {"source": "cve@mitre.org", "url": "http://packetstormsecurity.com/files/169458/Zimbra-Collaboration-Suite-TAR-Path-Traversal.html"}, {"source": "cve@mitre.org", "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:066"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://www.openwall.com/lists/oss-security/2015/01/07/5"}, {"source": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2015/01/18/7"}, {"source": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2023/12/21/8"}, {"source": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2023/12/27/1"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/71914"}, {"source": "cve@mitre.org", "url": "http://www.ubuntu.com/usn/USN-2906-1"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774669"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "https://lists.gnu.org/archive/html/bug-cpio/2015-01/msg00000.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://advisories.mageia.org/MGASA-2015-0080.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://packetstormsecurity.com/files/169458/Zimbra-Collaboration-Suite-TAR-Path-Traversal.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:066"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://www.openwall.com/lists/oss-security/2015/01/07/5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2015/01/18/7"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2023/12/21/8"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2023/12/27/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/71914"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.ubuntu.com/usn/USN-2906-1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774669"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "https://lists.gnu.org/archive/html/bug-cpio/2015-01/msg00000.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}