CVE-2014-9983

Directory Traversal exists in RAR 4.x and 5.x because an unpack operation follows any symlinks, including symlinks contained in the archive. This allows remote attackers to write to arbitrary files via a crafted archive.

CVSS v3.0

5.5 MEDIUMCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

1.77% chance of exploitation in the next 30 days, 77th percentile

Published

2017-06-04

Updated

2024-08-06

Proof-of-concept exploits (1)

• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774172

References

• CVE Record
• NVD entry

Related

• CVE-2014-9938
• CVE-2014-9919
• CVE-2014-9918
• CVE-2014-9917
• CVE-2014-9916
• CVE-2014-9772