CVE-2006-0926

Severity: low (CVSS 2.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-02-28 · updated 2026-06-16

Description

Multiple directory traversal vulnerabilities in Allume StuffIt Standard and Deluxe 9.0, ZipMagic Deluxe 9.0, and StuffIt Expander 9.0.0.21 Engine 9.0.0.21 allow remote attackers to create and overwrite arbitrary files via certain crafted pathnames in a (1) zip or (2) tar archive.

Affected products

Smithmicro Stuffit Deluxe: 9.0
Smithmicro Stuffit Expander: 9.0.0.21_engine_9.0.0.21
Smithmicro Stuffit Standard: 9.0
Smithmicro Zipmagic Deluxe: 9.0

References

http://secunia.com/advisories/19010
http://www.hamid.ir/security/stuffit.txt
http://www.osvdb.org/23463
http://www.securityfocus.com/archive/1/425972/100/0/threaded
http://www.securityfocus.com/bid/16806
http://www.vupen.com/english/advisories/2006/0732
https://exchange.xforce.ibmcloud.com/vulnerabilities/24886
http://secunia.com/advisories/19010
http://www.hamid.ir/security/stuffit.txt
http://www.osvdb.org/23463
http://www.securityfocus.com/archive/1/425972/100/0/threaded
http://www.securityfocus.com/bid/16806

Get alerted when CVE-2006-0926 or the next vulnerability affects your stack