CVE-2022-4515
A flaw was found in Exuberant Ctags in the way it handles the "-o" option. This option specifies...
A flaw was found in Exuberant Ctags in the way it handles the "-o" option. This option specifies the tag filename. A crafted tag filename specified in the command line or in the configuration file results in arbitrary command execution because the externalSortTags() in sort.c calls the system(3) function in an unsafe way.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A flaw was found in Exuberant Ctags in the way it handles the "-o" option. This option specifies the tag filename. A crafted tag filename specified in the command line or in the configuration file results in arbitrary command execution because the externalSortTags() in sort.c calls the system(3) function in an unsafe way.
- Record
CVE-2022-4515- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
CVE List
A flaw was found in Exuberant Ctags in the way it handles the "-o" option. This option specifies the tag filename. A crafted tag filename specified in the command line or in the configuration file results in arbitrary command execution because the externalSortTags() in sort.c calls the system(3) function in an unsafe way.
- Record
CVE-2022-4515- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
EUVDEUVD-2022-51855
A flaw was found in Exuberant Ctags in the way it handles the "-o" option. This option specifies the tag filename. A crafted tag filename specified in the command line or in the configuration file results in arbitrary command execution because the externalSortTags() in sort.c calls the system(3) function in an unsafe way.
- Record
EUVD-2022-51855- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-qr9x-29jh-mg6x
A flaw was found in Exuberant Ctags in the way it handles the "-o" option. This option specifies...
A flaw was found in Exuberant Ctags in the way it handles the "-o" option. This option specifies the tag filename. A crafted tag filename specified in the command line or in the configuration file results in arbitrary command execution because the externalSortTags() in sort.c calls the system(3) function in an unsafe way.
- Record
GHSA-qr9x-29jh-mg6x- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
OSVAZL-12083
CVE-2022-4515 affecting package ctags for versions less than 5.9.20220619.0-7
A flaw was found in Exuberant Ctags in the way it handles the "-o" option. This option specifies the tag filename. A crafted tag filename specified in the command line or in the configuration file results in arbitrary command execution because the externalSortTags() in sort.c calls the system(3) function in an unsafe way.
- Record
AZL-12083- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVAZL-34647
CVE-2022-4515 affecting package ctags for versions less than 6.1.0-1
A flaw was found in Exuberant Ctags in the way it handles the "-o" option. This option specifies the tag filename. A crafted tag filename specified in the command line or in the configuration file results in arbitrary command execution because the externalSortTags() in sort.c calls the system(3) function in an unsafe way.
- Record
AZL-34647- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-05
Show 13 moreShow less
OSV
A flaw was found in Exuberant Ctags in the way it handles the "-o" option. This option specifies the tag filename. A crafted tag filename specified in the command line or in the configuration file results in arbitrary command execution because the externalSortTags() in sort.c calls the system(3) function in an unsafe way.
- Record
CVE-2022-4515- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-4515
A flaw was found in Exuberant Ctags in the way it handles the "-o" option. This option specifies the tag filename. A crafted tag filename specified in the command line or in the configuration file results in arbitrary command execution because the externalSortTags() in sort.c calls the system(3) function in an unsafe way.
- Record
DEBIAN-CVE-2022-4515- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSVOESA-2023-1693
ctags security update
Ctags generates an index (or tag) file of language objects found in source files that allows these items to be quickly and easily located by a text editor or other utility. A tag signifies a language object for which an index entry is available (or, alternatively, the index entry created for that object).
Security Fix(es):
A flaw was found in Exuberant Ctags in the way it handles the "-o" option. This option specifies the tag filename. A crafted tag filename specified in the command line or in the configuration file results in arbitrary command execution because the externalSortTags() in sort.c calls the system(3) function in an unsafe way.(CVE-2022-4515)
- Record
OESA-2023-1693- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2023-1694
ctags security update
Ctags generates an index (or tag) file of language objects found in source files that allows these items to be quickly and easily located by a text editor or other utility. A tag signifies a language object for which an index entry is available (or, alternatively, the index entry created for that object).
Security Fix(es):
A flaw was found in Exuberant Ctags in the way it handles the "-o" option. This option specifies the tag filename. A crafted tag filename specified in the command line or in the configuration file results in arbitrary command execution because the externalSortTags() in sort.c calls the system(3) function in an unsafe way.(CVE-2022-4515)
- Record
OESA-2023-1694- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2023:2863
Red Hat Security Advisory: ctags security update
- Record
RHSA-2023:2863- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2023:2863
Moderate: ctags security update
Ctags is a C programming language indexing and cross-reference tool.
Security Fix(es):
- ctags: arbitrary command execution via a tag file with a crafted filename (CVE-2022-4515)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 8.8 Release Notes linked from the References section.
- Record
RLSA-2023:2863- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-4515
A flaw was found in Exuberant Ctags in the way it handles the "-o" option. This option specifies the tag filename. A crafted tag filename specified in the command line or in the configuration file results in arbitrary command execution because the externalSortTags() in sort.c calls the system(3) function in an unsafe way.
- Record
UBUNTU-CVE-2022-4515- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVALSA-2023:2863 No score
Moderate: ctags security update
Ctags is a C programming language indexing and cross-reference tool.
Security Fix(es):
- ctags: arbitrary command execution via a tag file with a crafted filename (CVE-2022-4515)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
- Record
ALSA-2023:2863- Updated
- 2026-11-02
OSVMGASA-2023-0003 No score
Updated ctags packages fix security vulnerability
A flaw was found in Exuberant Ctags in the way it handles the "-o" option. This option specifies the tag filename. A crafted tag filename specified in the command line or in the configuration file results in arbitrary command execution because the externalSortTags() in sort.c calls the system(3) function in an unsafe way. (CVE-2022-4515)
- Record
MGASA-2023-0003- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12624-1 No score
ctags-5.8-12.1 on GA media
These are all security issues fixed in the ctags-5.8-12.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12624-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:0224-1 No score
Security update for ctags
This update for ctags fixes the following issues:
- CVE-2022-4515: Fixed a command injection issue via a tag file wih a crafted filename (bsc#1206543).
- Record
SUSE-SU-2023:0224-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:0225-1 No score
Security update for ctags
This update for ctags fixes the following issues:
- CVE-2022-4515: Fixed a command injection issue via a tag file wih a crafted filename (bsc#1206543).
- Record
SUSE-SU-2023:0225-1- Updated
- 2026-11-02
OSVUSN-5820-1 No score
exuberant-ctags vulnerability
Lorenz Hipp discovered a flaw in exuberant-ctags handling of the tag filename command-line argument. A crafted tag filename specified in the command line or in the configuration file could result in arbitrary command execution.
- Record
USN-5820-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ctagsAlmaLinux:8 |
before 5.8-23.el8 | 5.8-23.el8 |
ctags-etagsAlmaLinux:8 |
before 5.8-23.el8 | 5.8-23.el8 |
ctagsAzure Linux:2 |
before 5.9.20220619.0-7 | 5.9.20220619.0-7 |
ctagsAzure Linux:3 |
before 6.1.0-1 | 6.1.0-1 |
exuberant-ctagsDebian:12 |
before 1:5.9~svn20110310-18 | 1:5.9~svn20110310-18 |
exuberant-ctagsDebian:13 |
before 1:5.9~svn20110310-18 | 1:5.9~svn20110310-18 |
exuberant-ctagsDebian:14 |
before 1:5.9~svn20110310-18 | 1:5.9~svn20110310-18 |
exuberant-ctagsDebian:10 |
before 1:5.9~svn20110310-12+deb10u1, plus listed versions 1:5.9~svn20110310-12 |
1:5.9~svn20110310-12+deb10u1 |
ctagsMageia:8 |
before 5.8-15.1.mga8 | 5.8-15.1.mga8 |
ctagsopenEuler:20.03-LTS-SP3 |
before 5.8-28.oe1 | 5.8-28.oe1 |
Show 36 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ctagsopenEuler:22.03-LTS-SP2 |
before 5.8-29.oe2203sp2 | 5.8-29.oe2203sp2 |
ctagsRed Hat:enterprise_linux:8::appstream |
before 0:5.8-23.el8 | 0:5.8-23.el8 |
ctags-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:5.8-23.el8 | 0:5.8-23.el8 |
ctags-debugsourceRed Hat:enterprise_linux:8::appstream |
before 0:5.8-23.el8 | 0:5.8-23.el8 |
ctags-debuginfoRed Hat:enterprise_linux:8::crb |
before 0:5.8-23.el8 | 0:5.8-23.el8 |
ctags-debugsourceRed Hat:enterprise_linux:8::crb |
before 0:5.8-23.el8 | 0:5.8-23.el8 |
ctags-etagsRed Hat:enterprise_linux:8::crb |
before 0:5.8-23.el8 | 0:5.8-23.el8 |
ctagsRocky Linux:8 |
before 0:5.8-23.el8 | 0:5.8-23.el8 |
ctagsSUSE:OpenStack Cloud 9 |
before 5.8-8.3.1 | 5.8-8.3.1 |
ctagsSUSE:OpenStack Cloud Crowbar 9 |
before 5.8-8.3.1 | 5.8-8.3.1 |
ctagsSUSE:Linux Enterprise Server for SAP Applications 12 SP4 |
before 5.8-8.3.1 | 5.8-8.3.1 |
ctagsSUSE:Linux Enterprise Server 12 SP2-BCL |
before 5.8-8.3.1 | 5.8-8.3.1 |
ctagsSUSE:Linux Enterprise Server 12 SP4-LTSS |
before 5.8-8.3.1 | 5.8-8.3.1 |
ctagsSUSE:Linux Enterprise Server 12 SP5 |
before 5.8-8.3.1 | 5.8-8.3.1 |
ctagsSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 5.8-8.3.1 | 5.8-8.3.1 |
ctagsSUSE:Linux Enterprise Module for Development Tools 15 SP4 |
before 5.8-150000.3.3.1 | 5.8-150000.3.3.1 |
ctagsSUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS |
before 5.8-150000.3.3.1 | 5.8-150000.3.3.1 |
ctagsSUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS |
before 5.8-150000.3.3.1 | 5.8-150000.3.3.1 |
ctagsSUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS |
before 5.8-150000.3.3.1 | 5.8-150000.3.3.1 |
ctagsSUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS |
before 5.8-150000.3.3.1 | 5.8-150000.3.3.1 |
ctagsSUSE:Linux Enterprise Real Time 15 SP3 |
before 5.8-150000.3.3.1 | 5.8-150000.3.3.1 |
ctagsSUSE:Linux Enterprise Server 15 SP1-LTSS |
before 5.8-150000.3.3.1 | 5.8-150000.3.3.1 |
ctagsSUSE:Linux Enterprise Server 15 SP2-LTSS |
before 5.8-150000.3.3.1 | 5.8-150000.3.3.1 |
ctagsSUSE:Linux Enterprise Server 15 SP3-LTSS |
before 5.8-150000.3.3.1 | 5.8-150000.3.3.1 |
ctagsSUSE:Linux Enterprise Server for SAP Applications 15 SP1 |
before 5.8-150000.3.3.1 | 5.8-150000.3.3.1 |
ctagsSUSE:Linux Enterprise Server for SAP Applications 15 SP2 |
before 5.8-150000.3.3.1 | 5.8-150000.3.3.1 |
ctagsSUSE:Linux Enterprise Server for SAP Applications 15 SP3 |
before 5.8-150000.3.3.1 | 5.8-150000.3.3.1 |
ctagsSUSE:Enterprise Storage 6 |
before 5.8-150000.3.3.1 | 5.8-150000.3.3.1 |
ctagsSUSE:Enterprise Storage 7 |
before 5.8-150000.3.3.1 | 5.8-150000.3.3.1 |
ctagsSUSE:Enterprise Storage 7.1 |
before 5.8-150000.3.3.1 | 5.8-150000.3.3.1 |
ctagsopenSUSE:Leap 15.4 |
before 5.8-150000.3.3.1 | 5.8-150000.3.3.1 |
exuberant-ctagsUbuntu:Pro:16.04:LTS |
before 1:5.9~svn20110310-11ubuntu0.1~esm1, plus listed versions 1:5.9~svn20110310-91:5.9~svn20110310-101:5.9~svn20110310-11 |
1:5.9~svn20110310-11ubuntu0.1~esm1 |
exuberant-ctagsUbuntu:18.04:LTS |
before 1:5.9~svn20110310-11ubuntu0.1, plus listed versions 1:5.9~svn20110310-11 |
1:5.9~svn20110310-11ubuntu0.1 |
exuberant-ctagsUbuntu:20.04:LTS |
before 1:5.9~svn20110310-12ubuntu0.1, plus listed versions 1:5.9~svn20110310-12 |
1:5.9~svn20110310-12ubuntu0.1 |
exuberant-ctagsUbuntu:22.04:LTS |
before 1:5.9~svn20110310-16ubuntu0.22.04.1, plus listed versions 1:5.9~svn20110310-151:5.9~svn20110310-161:5.9~svn20110310-16build1 |
1:5.9~svn20110310-16ubuntu0.22.04.1 |
ctagsopenSUSE:Tumbleweed |
before 5.8-12.1 | 5.8-12.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-4515 is a high vulnerability (CVSS 7.8) in Exuberant Ctags Project Ctags, published December 20, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.61%, the 49th percentile. Fixed in ctags 5.8-23.el8.
References
sourceforge.net/p/ctags/code/HEAD/tree/tags/ctags-5.8/sort.c
lists.debian.org/debian-lts-announce/2022/12/msg00040.html
nvd.nist.gov/vuln/detail/CVE-2022-4515
github.com/advisories/GHSA-qr9x-29jh-mg6x
access.redhat.com/errata/RHSA-2023:2863
Show 20 moreShow less
bugzilla.redhat.com/2153519
errata.almalinux.org/8/ALSA-2023-2863.html
security-tracker.debian.org/tracker/CVE-2022-4515
advisories.mageia.org/MGASA-2023-0003.html
bugs.mageia.org/show_bug.cgi?id=31359
debian.org/lts/security/2022/dla-3254
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1693
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2863.json
cve.org/CVERecord?id=CVE-2022-4515
errata.rockylinux.org/RLSA-2023:2863
suse.com/support/update/announcement/2023/suse-su-20230224-1
bugzilla.suse.com/1206543
ubuntu.com/security/CVE-2022-4515