{"cve":"CVE-2021-40153","nvd":{"published":"2021-08-27T15:15:09.657","modified":"2026-06-17T04:06:36.063","status":"Modified","description":"squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations outside of the destination.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","score":8.1},"cwes":["CWE-22"],"references":["https://bugs.launchpad.net/ubuntu/+source/squashfs-tools/+bug/1941790","https://github.com/plougher/squashfs-tools/commit/79b5a555058eef4e1e7ff220c344d39f8cd09646","https://github.com/plougher/squashfs-tools/issues/72","https://lists.debian.org/debian-lts-announce/2021/08/msg00030.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GSMRKVJMJFX3MB7D3PXJSYY3TLZROE5S/"],"products":["debian:debian_linux","fedoraproject:fedora","redhat:enterprise_linux","squashfs-tools_project:squashfs-tools"],"source":"nvd","synced_at":"2026-10-19T21:21:57.125947417+00:00"},"epss":{"cve":"CVE-2021-40153","score":0.025,"percentile":0.84699,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}