PulseLinuxLINUX UPDATE INTELLIGENCE
CVE Database›Document archive›CVE-2019-10220

CVE-2019-10220

kernel: CIFS: Relative paths injection in directory entry lists

Loading…

Severity

Important

Red Hat Product Security

8

CVSS 3.0

Review impact separately from score.

Published · November 28, 2019

Updated · June 28, 2026

Description

A flaw was found in the Linux kernel's SMB client. Path separators are not checked by cifs.ko when parsing directory listings back. A bad server can return relative paths that will be returned as-is to userspace potentially leading to manipulating of files outside shared mount points. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.0 · 8
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')