CVE-2016-7162
The _g_file_remove_directory function in file-utils.c in File Roller 3.5.4 through 3.20.2 allows...
CVE-2016-7162 is a high vulnerability (CVSS 7.5) in File Roller Project Roller, published September 8, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.33%, the 88th percentile. Fixed in file-roller 3.20.3-1.
The _g_file_remove_directory function in file-utils.c in File Roller 3.5.4 through 3.20.2 allows remote attackers to delete arbitrary files via a symlink attack on a folder in an archive.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The _g_file_remove_directory function in file-utils.c in File Roller 3.5.4 through 3.20.2 allows remote attackers to delete arbitrary files via a symlink attack on a folder in an archive.
- Record
CVE-2016-7162- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The _g_file_remove_directory function in file-utils.c in File Roller 3.5.4 through 3.20.2 allows remote attackers to delete arbitrary files via a symlink attack on a folder in an archive.
- Record
CVE-2016-7162- Updated
- 2026-11-02
EUVDEUVD-2016-8030 No score
The _g_file_remove_directory function in file-utils.c in File Roller 3.5.4 through 3.20.2 allows remote attackers to delete arbitrary files via a symlink attack on a folder in an archive.
- Record
EUVD-2016-8030- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g3mg-grgw-vqfv
The _g_file_remove_directory function in file-utils.c in File Roller 3.5.4 through 3.20.2 allows...
The _g_file_remove_directory function in file-utils.c in File Roller 3.5.4 through 3.20.2 allows remote attackers to delete arbitrary files via a symlink attack on a folder in an archive.
- Record
GHSA-g3mg-grgw-vqfv- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
The _g_file_remove_directory function in file-utils.c in File Roller 3.5.4 through 3.20.2 allows remote attackers to delete arbitrary files via a symlink attack on a folder in an archive.
- Record
CVE-2016-7162- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-7162
The _g_file_remove_directory function in file-utils.c in File Roller 3.5.4 through 3.20.2 allows remote attackers to delete arbitrary files via a symlink attack on a folder in an archive.
- Record
DEBIAN-CVE-2016-7162- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-7162
The _g_file_remove_directory function in file-utils.c in File Roller 3.5.4 through 3.20.2 allows remote attackers to delete arbitrary files via a symlink attack on a folder in an archive.
- Record
UBUNTU-CVE-2016-7162- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVMGASA-2016-0313 No score
Updated file-roller packages fix security vulnerability
It was discovered that File Roller incorrectly handled symlinks. If a user were tricked into extracting a specially-crafted archive, an attacker could delete files outside of the extraction directory.
- Record
MGASA-2016-0313- Updated
- 2026-11-02
OSVUSN-3074-1 No score
file-roller vulnerability
It was discovered that File Roller incorrectly handled symlinks. If a user were tricked into extracting a specially-crafted archive, an attacker could delete files outside of the extraction directory.
- Record
USN-3074-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
file-rollerDebian:12 |
before 3.20.3-1 | 3.20.3-1 |
file-rollerDebian:13 |
before 3.20.3-1 | 3.20.3-1 |
file-rollerDebian:14 |
before 3.20.3-1 | 3.20.3-1 |
file-rollerMageia:5 |
before 3.14.2-1.1.mga5 | 3.14.2-1.1.mga5 |
file-rollerUbuntu:14.04:LTS |
before 3.10.2.1-0ubuntu4.2, plus listed versions 3.10.0-0ubuntu13.10.1-0ubuntu13.10.2.1-0ubuntu13.10.2.1-0ubuntu23.10.2.1-0ubuntu33.10.2.1-0ubuntu43.10.2.1-0ubuntu4.1 |
3.10.2.1-0ubuntu4.2 |
file-rollerUbuntu:16.04:LTS |
before 3.16.5-0ubuntu1.2, plus listed versions 3.16.4-1ubuntu33.16.5-0ubuntu13.16.5-0ubuntu1.1 |
3.16.5-0ubuntu1.2 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
securityfocus.com/bid/92896
git.gnome.org/browse/file-roller/commit?id=f70be1f41688859ec8dbe266df35a1839ceb96c5
ftp.gnome.org/mirror/gnome.org/sources/file-roller/3.20/file-roller-3.20.3.news
bugzilla.gnome.org/show_bug.cgi?id=698554
openwall.com/lists/oss-security/2016/09/08/4
ubuntu.com/usn/USN-3074-1
Show 11 moreShow less
nvd.nist.gov/vuln/detail/CVE-2016-7162
github.com/advisories/GHSA-g3mg-grgw-vqfv
security-tracker.debian.org/tracker/CVE-2016-7162
advisories.mageia.org/MGASA-2016-0313.html
bugs.mageia.org/show_bug.cgi?id=19312
ubuntu.com/security/CVE-2016-7162
cve.org/CVERecord?id=CVE-2016-7162
launchpad.net/bugs/1171236