CVE-2016-2087
Directory traversal vulnerability in the client in HexChat 2.11.0 allows remote IRC servers to...
Directory traversal vulnerability in the client in HexChat 2.11.0 allows remote IRC servers to read or modify arbitrary files via a .. (dot dot) in the server name.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Directory traversal vulnerability in the client in HexChat 2.11.0 allows remote IRC servers to read or modify arbitrary files via a .. (dot dot) in the server name.
- Record
CVE-2016-2087- CVSS 3.0
- 7.4 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
Directory traversal vulnerability in the client in HexChat 2.11.0 allows remote IRC servers to read or modify arbitrary files via a .. (dot dot) in the server name.
- Record
CVE-2016-2087- Updated
- 2026-11-02
EUVDEUVD-2016-3192 No score
Directory traversal vulnerability in the client in HexChat 2.11.0 allows remote IRC servers to read or modify arbitrary files via a .. (dot dot) in the server name.
- Record
EUVD-2016-3192- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r36g-f4rx-gr5p
Directory traversal vulnerability in the client in HexChat 2.11.0 allows remote IRC servers to...
Directory traversal vulnerability in the client in HexChat 2.11.0 allows remote IRC servers to read or modify arbitrary files via a .. (dot dot) in the server name.
- Record
GHSA-r36g-f4rx-gr5p- CVSS 3.0
- 7.4 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
Directory traversal vulnerability in the client in HexChat 2.11.0 allows remote IRC servers to read or modify arbitrary files via a .. (dot dot) in the server name.
- Record
CVE-2016-2087- CVSS 3.0
- 7.4 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-2087
Directory traversal vulnerability in the client in HexChat 2.11.0 allows remote IRC servers to read or modify arbitrary files via a .. (dot dot) in the server name.
- Record
DEBIAN-CVE-2016-2087- CVSS 3.0
- 7.4 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-2087
Directory traversal vulnerability in the client in HexChat 2.11.0 allows remote IRC servers to read or modify arbitrary files via a .. (dot dot) in the server name.
- Record
UBUNTU-CVE-2016-2087- CVSS 3.0
- 7.4 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVSUSE-SU-2020:2872-1 No score
Security update for hexchat
This update for hexchat fixes the following issues:
- CVE-2016-2087: A directory traversal was possible if a user could be convinced to connect to a server with a hostname with '..' in its name. (bsc#1020739).
This non-security issue was fixed:
- Add dependency on iso-codes and hwdata as hexchat tries to use them (bsc#1034310)
- Record
SUSE-SU-2020:2872-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
hexchatDebian:12 |
before 2.12.4-4 | 2.12.4-4 |
hexchatDebian:13 |
before 2.12.4-4 | 2.12.4-4 |
xchatDebian:7 |
before 2.8.8-7.1+deb7u1, plus listed versions 2.8.8-7.1 |
2.8.8-7.1+deb7u1 |
hexchatSUSE:Linux Enterprise Workstation Extension 12 SP5 |
before 2.12.0-6.5.146 | 2.12.0-6.5.146 |
xchat-gnomeUbuntu:16.04:LTS |
All versions, plus listed versions 1:0.30.0~git20141005.816798-0ubuntu61:0.30.0~git20141005.816798-0ubuntu71:0.30.0~git20141005.816798-0ubuntu81:0.30.0~git20141005.816798-0ubuntu9 |
None known |
hexchatUbuntu:16.04:LTS |
All versions, plus listed versions 2.10.2-1ubuntu22.10.2-1ubuntu3 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Hexchat IRC Client 2.11.0 - Directory Traversal | 2016-04-04 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-2087 is a high vulnerability (CVSS 7.4) in Hexchat Project Hexchat, published January 18, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 9.49%, the 95th percentile. Fixed in hexchat 2.12.4-4.