What’s Vulnerable › Vulnerabilities

CVE-2018-12473: path traversal in obs-service-tar_scm

• Severity: high (CVSS 7.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-10-02 · updated 2026-06-17
• Weakness: CWE-23

Description

A path traversal traversal vulnerability in obs-service-tar_scm of Open Build Service allows remote attackers to cause access files not in the current build. On the server itself this is prevented by confining the worker via KVM. Affected releases are openSUSE Open Build Service: versions prior to 70d1aa4cc4d7b940180553a63805c22fc62e2cf0.

Affected products

• openSUSE Open Build Service: through 0.9.1

References

• https://bugzilla.suse.com/show_bug.cgi?id=1105361
• https://github.com/openSUSE/obs-service-tar_scm/pull/248
• https://bugzilla.suse.com/show_bug.cgi?id=1105361
• https://github.com/openSUSE/obs-service-tar_scm/pull/248

Get alerted when CVE-2018-12473 or the next vulnerability affects your stack