CVE-2013-2900
The FilePath::ReferencesParent function in files/file_path.cc in Google Chrome before 29.0.1547...
The FilePath::ReferencesParent function in files/file_path.cc in Google Chrome before 29.0.1547.57 on Windows does not properly handle pathname components composed entirely of . (dot) and whitespace characters, which allows remote attackers to conduct directory traversal attacks via a crafted directory name.
Exploit likelihood
What each source reports
NVD Score used
The FilePath::ReferencesParent function in files/file_path.cc in Google Chrome before 29.0.1547.57 on Windows does not properly handle pathname components composed entirely of . (dot) and whitespace characters, which allows remote attackers to conduct directory traversal attacks via a crafted directory name.
- Record
CVE-2013-2900- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
The FilePath::ReferencesParent function in files/file_path.cc in Google Chrome before 29.0.1547.57 on Windows does not properly handle pathname components composed entirely of . (dot) and whitespace characters, which allows remote attackers to conduct directory traversal attacks via a crafted directory name.
- Record
CVE-2013-2900- Updated
- 2026-11-02
EUVDEUVD-2013-2839 No score
The FilePath::ReferencesParent function in files/file_path.cc in Google Chrome before 29.0.1547.57 on Windows does not properly handle pathname components composed entirely of . (dot) and whitespace characters, which allows remote attackers to conduct directory traversal attacks via a crafted directory name.
- Record
EUVD-2013-2839- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6j6r-x8xq-r7gq No score
The FilePath::ReferencesParent function in files/file_path.cc in Google Chrome before 29.0.1547...
The FilePath::ReferencesParent function in files/file_path.cc in Google Chrome before 29.0.1547.57 on Windows does not properly handle pathname components composed entirely of . (dot) and whitespace characters, which allows remote attackers to conduct directory traversal attacks via a crafted directory name.
- Record
GHSA-6j6r-x8xq-r7gq- Weakness
- CWE-22
- Updated
- 2026-11-02
OSVMGASA-2013-0278 No score
Updated chromium-browser-stable package fix security vulnerabilities
The chrome 29 development team found various issues from internal fuzzing audits, and other studies (CVE-2013-2887).
Krystian Bigaj discovered a file handling path sanitization issue (CVE-2013-2900).
Alex Chapman discovered an integer overflow issue in ANGLE, the Almost Native Graphics Layer (CVE-2013-2901).
cloudfuzzer discovered a use-after-free issue in XSLT (CVE-2013-2902).
cloudfuzzer discovered a use-after-free issue in HTMLMediaElement (CVE-2013-2903).
cloudfuzzer discovered a use-after-free issue in XML document parsing (CVE-2013-2904).
Christian Jaeger discovered an information leak due to insufficient file permissions (CVE-2013-2905).
- Record
MGASA-2013-0278- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
chromium-browserDebian:7 From an advisory covering 7 CVEs |
before 29.0.1547.57-1~deb7u1, plus listed versions 26.0.1410.43-127.0.1453.110-127.0.1453.110-1~deb7u127.0.1453.110-227.0.1453.93-1 Show 8 moreShow less27.0.1453.93-1~deb7u128.0.1500.71-128.0.1500.71-1~deb7u128.0.1500.71-228.0.1500.95-128.0.1500.95-1~deb7u128.0.1500.95-228.0.1500.95-3 |
29.0.1547.57-1~deb7u1 |
chromium-browser-stableMageia:2 From an advisory covering 7 CVEs |
before 29.0.1547.65-1.mga2 | 29.0.1547.65-1.mga2 |
chromium-browser-stableMageia:3 From an advisory covering 7 CVEs |
before 29.0.1547.65-1.mga3 | 29.0.1547.65-1.mga3 |
chromium-browser-stableMageia:3 From an advisory covering 7 CVEs |
before 29.0.1547.65-1.mga3.tainted | 29.0.1547.65-1.mga3.tainted |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-2900 is a high vulnerability (CVSS 7.5) in Google Chrome, published August 21, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.71%, the 77th percentile. No source names a fixed version.
