CVE-2018-21269
checkpath in OpenRC through 0.42.1 might allow local users to take ownership of arbitrary files...
CVE-2018-21269 is a medium vulnerability (CVSS 5.5) in Openrc Project Openrc, published October 27, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 32nd percentile. Fixed in openrc 0.41.2-r2.
checkpath in OpenRC through 0.42.1 might allow local users to take ownership of arbitrary files because a non-terminal path component can be a symlink.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
checkpath in OpenRC through 0.42.1 might allow local users to take ownership of arbitrary files because a non-terminal path component can be a symlink.
- Record
CVE-2018-21269- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-59
- Updated
- 2026-11-02
CVE List No score
checkpath in OpenRC through 0.42.1 might allow local users to take ownership of arbitrary files because a non-terminal path component can be a symlink.
- Record
CVE-2018-21269- Updated
- 2026-11-02
EUVDEUVD-2018-13783 No score
checkpath in OpenRC through 0.42.1 might allow local users to take ownership of arbitrary files because a non-terminal path component can be a symlink.
- Record
EUVD-2018-13783- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-ww6f-fx4x-qw8g No score
checkpath in OpenRC through 0.42.1 might allow local users to take ownership of arbitrary files...
checkpath in OpenRC through 0.42.1 might allow local users to take ownership of arbitrary files because a non-terminal path component can be a symlink.
- Record
GHSA-ww6f-fx4x-qw8g- Weakness
- CWE-59
- Updated
- 2026-11-02
OSVALPINE-CVE-2018-21269
checkpath in OpenRC through 0.42.1 might allow local users to take ownership of arbitrary files because a non-terminal path component can be a symlink.
- Record
ALPINE-CVE-2018-21269- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSV
checkpath in OpenRC through 0.42.1 might allow local users to take ownership of arbitrary files because a non-terminal path component can be a symlink.
- Record
CVE-2018-21269- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-21269
checkpath in OpenRC through 0.42.1 might allow local users to take ownership of arbitrary files because a non-terminal path component can be a symlink.
- Record
DEBIAN-CVE-2018-21269- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openrcAlpine:v3.10 |
before 0.41.2-r2 | 0.41.2-r2 |
openrcAlpine:v3.11 |
before 0.42.1-r3 | 0.42.1-r3 |
openrcAlpine:v3.12 |
before 0.42.1-r12 | 0.42.1-r12 |
openrcAlpine:v3.13 |
before 0.42.1-r20 | 0.42.1-r20 |
openrcDebian:12 |
before 0.45.2-1 | 0.45.2-1 |
openrcDebian:13 |
before 0.45.2-1 | 0.45.2-1 |
openrcDebian:14 |
before 0.45.2-1 | 0.45.2-1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |