High severity · published Sep 14, 2021
CVE-2021-41072
squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different vulnerability than CVE-2021-40153
8.1
CVSS
2.3%
EPSS
No
On KEV
Description
squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link and then contents under the same filename in a filesystem can cause unsquashfs to first create the symbolic link pointing outside the expected directory, and then the subsequent write operation will cause the unsquashfs process to write through the symbolic link elsewhere in the filesystem.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DL
Debian Linux · Debian
9.0; 10.0; 11.0 · source: NVD
SQ
Squashfs-tools · Squashfs-tools Project
4.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-41072
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-41072
Patch
https://github.com/plougher/squashfs-tools/commit/e0485802ec72996c20026da320650d8362f555bd
Exploit
https://github.com/plougher/squashfs-tools/issues/72#issuecomment-913833405
Mailing List
https://lists.debian.org/debian-lts-announce/2021/10/msg00017.html
security.gentoo.org
https://security.gentoo.org/glsa/202305-29
Third Party Advisory
https://www.debian.org/security/2021/dsa-4987
More from Debian Linux
10.0
CVE-2025-32433
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
10.0
CVE-2025-24201
Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability
10.0
CVE-2021-44228
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
10.0
CVE-2015-3306
ProFTPD Improper Access Control Vulnerability
9.8
CVE-2026-111497
Out-of-Bounds Write in Google Brotli Decoder
