CVE-2013-4668

Directory traversal vulnerability in File Roller 3.6.x before 3.6.4, 3.8.x before 3.8.3, and 3.9...

5.0 MediumFix available

Directory traversal vulnerability in File Roller 3.6.x before 3.6.4, 3.8.x before 3.8.3, and 3.9.x before 3.9.3, when libarchive is used, allows remote attackers to create arbitrary files via a crafted archive that is not properly handled in a "Keep directory structure" action, related to fr-archive-libarchive.c and fr-window.c.

Exploit likelihood

4.31%Up 3.0 points since Feb 4, 2022

What each source reports

NVD Score used 5.0

Record: CVE-2013-4668
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness: CWE-22
Updated: 2026-11-02

CVE List No score

Record: CVE-2013-4668
Updated: 2026-11-02

EUVDEUVD-2013-4521 No score

Record: EUVD-2013-4521
Updated: 2026-11-03

GitHub AdvisoriesGHSA-g2xw-w8v5-q99p No score

Directory traversal vulnerability in File Roller 3.6.x before 3.6.4, 3.8.x before 3.8.3, and 3.9...

Record: GHSA-g2xw-w8v5-q99p
Weakness: CWE-22
Updated: 2026-11-02

OSV No score

Record: CVE-2013-4668
Updated: 2026-11-02

OSVDEBIAN-CVE-2013-4668 No score

Record: DEBIAN-CVE-2013-4668
Updated: 2026-11-02

OSVMGASA-2013-0232 No score

Updated file-roller package fixes CVE-2013-4668

Updated file-roller package fixes security vulnerability:

Directory traversal vulnerability in File Roller 3.6.x before 3.6.4 when libarchive is used, allows remote attackers to create arbitrary files via a crafted archive that is not properly handled in a "Keep directory structure" action, related to fr-archive-libarchive.c and fr-window.c (CVE-2013-4668).

Record: MGASA-2013-0232
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`file-roller` Debian:12	before 3.8.3-1	3.8.3-1
`file-roller` Debian:13	before 3.8.3-1	3.8.3-1
`file-roller` Debian:14	before 3.8.3-1	3.8.3-1
`file-roller` Mageia:3	before 3.6.4-1.mga3	3.6.4-1.mga3

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-4668 is a medium vulnerability (CVSS 5.0) in File Roller Project Roller, published July 18, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.31%, the 91st percentile. Fixed in file-roller 3.8.3-1.

References

Show 7 moreShow less