obs-service-extract_file's outfilename parameter allows to write files outside of package directory

published 2020-01-27 6y ago modified 2026-06-17 4mo ago also EUVD-2018-4446

cvss: 4.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.0%; EPSS 1.0% chance of exploitation in 30 days, percentile 63%
public exploits: 0; none known

Relative Path Traversal vulnerability in obs-service-tar_scm of SUSE Linux Enterprise Server 15; openSUSE Factory allows remote attackers with control over a repository to overwrite files on the machine of the local user if a malicious service is executed. This issue affects: SUSE Linux Enterprise Server 15 obs-service-tar_scm versions prior to 0.9.2.1537788075.fefaa74:. openSUSE Factory obs-service-tar_scm versions prior to 0.9.2.1537788075.fefaa74.

Patch / fix

fixed in 2 distros 1

SUSE SUSE Linux Enterprise Server 15 0.9.2.1537788075.fefaa74:
openSUSE Factory 0.9.2.1537788075.fefaa74

obs-service-tar_scm openSUSE Tumbleweed 0.10.28.1632141620.a8837d3-1.1
obs-service-tar_scm openSUSE Leap 15.0 0.10.5.1551309990.79898c7-lp150.2.3.1
obs-service-tar_scm Package Hub 15 0.10.5.1551309990.79898c7-bp150.3.3.1

opensuse advisories openSUSE-SU-2024:11107-1 openSUSE-SU-2019:0326-1 openSUSE-SU-2019:0329-1

Is CVE-2018-12476 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Exploit prediction

1.03% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
CNA	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD	2.0	6.4	AV:N/AC:L/Au:N/C:N/I:P/A:P

Affected products

SUSE SUSE Linux Enterprise Server 15
openSUSE Factory

Classification

Weakness

CWE-23 Relative Path Traversal
CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

bugzilla.suse.com /show_bug.cgi?id=1107944

Sources

CVE List CVE-2018-12476
NVD CVE-2018-12476

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.