CVE-2017-16667

Severity: high (CVSS 7.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-11-08 · updated 2026-06-17
Weakness: CWE-78

Description

backintime (aka Back in Time) before 1.1.24 did improper escaping/quoting of file paths used as arguments to the 'notify-send' command, leading to some parts of file paths being executed as shell commands within an os.system call in qt4/plugins/notifyplugin.py. This could allow an attacker to craft an unreadable file with a specific name to run arbitrary shell commands.

Affected products

Backintime Project Backintime: before 1.1.24 — fixed in 1.1.24

How to fix

Upgrade to a fixed version: Backintime Project Backintime 1.1.24. Check the vendor advisory for mitigations.

References

https://github.com/bit-team/backintime/commit/cef81d0da93ff601252607df3db1a48f7f6f01b3
https://github.com/bit-team/backintime/issues/834
https://github.com/bit-team/backintime/releases/tag/v1.1.24
https://security.gentoo.org/glsa/201801-06
https://github.com/bit-team/backintime/commit/cef81d0da93ff601252607df3db1a48f7f6f01b3
https://github.com/bit-team/backintime/issues/834
https://github.com/bit-team/backintime/releases/tag/v1.1.24
https://security.gentoo.org/glsa/201801-06

Get alerted when CVE-2017-16667 or the next vulnerability affects your stack