CVE-2023-7207

· MEDIUMAnalyzed

← All CVEs

CVSS v3.1

4.9

EPSS

0.91%

Published

Feb 28, 2024

Modified

Aug 26, 2025

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Debian's cpio contains a path traversal vulnerability. This issue was introduced by reverting CVE-2015-1197 patches which had caused a regression in --no-absolute-filenames. Upstream has since provided a proper fix to --no-absolute-filenames.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-22

Affected Products (1)

gnu · cpiovulnerable

References (10)

http://www.openwall.com/lists/oss-security/2024/01/05/1

Mailing List

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1059163

Issue Tracking

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-7207

Third Party Advisory

https://git.savannah.gnu.org/cgit/cpio.git/commit/?id=376d663340a9dc91c91a5849e5713f07571c1628

Mailing ListPatch

https://www.openwall.com/lists/oss-security/2023/12/21/8

Mailing List

http://www.openwall.com/lists/oss-security/2024/01/05/1

Mailing List

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1059163

Issue Tracking

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-7207

Third Party Advisory

https://git.savannah.gnu.org/cgit/cpio.git/commit/?id=376d663340a9dc91c91a5849e5713f07571c1628

Mailing ListPatch

https://www.openwall.com/lists/oss-security/2023/12/21/8

Mailing List

KEV Catalog EPSS Scores Vendors All CVEs