CVE-2021-40153

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-08-27 · updated 2026-06-17
Weakness: CWE-22

Description

squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations outside of the destination.

Affected products

Debian Linux: 9.0, 10.0
Fedoraproject Fedora: 34, 33
Red Hat Enterprise Linux: 7.0, 8.0
Squashfs-Tools Project Squashfs-Tools: 4.5

References

https://bugs.launchpad.net/ubuntu/+source/squashfs-tools/+bug/1941790
https://github.com/plougher/squashfs-tools/commit/79b5a555058eef4e1e7ff220c344d39f8cd09646
https://github.com/plougher/squashfs-tools/issues/72
https://lists.debian.org/debian-lts-announce/2021/08/msg00030.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GSMRKVJMJFX3MB7D3PXJSYY3TLZROE5S/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RAOZ4BKWAC4Y3U2K5MMW3S77HWWXHQDL/
https://security.gentoo.org/glsa/202305-29
https://www.debian.org/security/2021/dsa-4967
https://bugs.launchpad.net/ubuntu/+source/squashfs-tools/+bug/1941790
https://github.com/plougher/squashfs-tools/commit/79b5a555058eef4e1e7ff220c344d39f8cd09646
https://github.com/plougher/squashfs-tools/issues/72
https://lists.debian.org/debian-lts-announce/2021/08/msg00030.html

Get alerted when CVE-2021-40153 or the next vulnerability affects your stack