CVE-2026-8274
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
A vulnerability was detected in cramfs-tools up to version 2.1. The do_directory function in cramfsck.c (Directory Handler) allows path traversal. The attack can only be performed locally, and the exploit has been publicly disclosed.
Risk Assessment
A local attacker could exploit path traversal to read or manipulate files outside the intended directory, potentially leading to data disclosure or filesystem corruption.
Recommendation
Upgrade cramfs-tools to version 2.2 or later, which contains the fix (commit 2fc492747115b24d8a07eddd27a2d45229cb273c).
Other vulnerabilities in cramfs-tools
Original NVD description (English source)
A security vulnerability has been detected in npitre cramfs-tools up to 2.1. Affected is the function do_directory of the file cramfsck.c of the component Directory Handler. Such manipulation leads to path traversal. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. Upgrading to version 2.2 is able to address this issue. The name of the patch is 2fc492747115b24d8a07eddd27a2d45229cb273c. Upgrading the affected component is recommended.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS