CVE-2019-13241
FlightCrew v0.9.2 and older are vulnerable to a directory traversal, allowing attackers to write...
FlightCrew v0.9.2 and older are vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive entry that is mishandled during extraction.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
FlightCrew v0.9.2 and older are vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive entry that is mishandled during extraction.
- Record
CVE-2019-13241- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
FlightCrew v0.9.2 and older are vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive entry that is mishandled during extraction.
- Record
CVE-2019-13241- Updated
- 2026-11-02
EUVDEUVD-2019-4748 No score
FlightCrew v0.9.2 and older are vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive entry that is mishandled during extraction.
- Record
EUVD-2019-4748- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jff3-mqp2-2qvx
FlightCrew v0.9.2 and older are vulnerable to a directory traversal, allowing attackers to write...
FlightCrew v0.9.2 and older are vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive entry that is mishandled during extraction.
- Record
GHSA-jff3-mqp2-2qvx- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
FlightCrew v0.9.2 and older are vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive entry that is mishandled during extraction.
- Record
CVE-2019-13241- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-13241
FlightCrew v0.9.2 and older are vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive entry that is mishandled during extraction.
- Record
DEBIAN-CVE-2019-13241- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-13241
FlightCrew v0.9.2 and older are vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive entry that is mishandled during extraction.
- Record
UBUNTU-CVE-2019-13241- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2019-0396 No score
Updated flightcrew packages fix security vulnerabilities
The updated packages fix security vulnerabilities:
An issue was discovered in FlightCrew v0.9.2 and earlier. A NULL pointer dereference occurs in GetRelativePathToNcx() or GetRelativePathsToXhtmlDocuments() when a NULL pointer is passed to xc::XMLUri::isValidURI(). This affects third-party software (not Sigil) that uses FlightCrew as a library. (CVE-2019-13032)
FlightCrew v0.9.2 and older are vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive entry that is mishandled during extraction. (CVE-2019-13241)
- Record
MGASA-2019-0396- Updated
- 2026-11-02
OSVUSN-4055-1 No score
flightcrew vulnerabilities
Mike Salvatore discovered that FlightCrew improperly handled certain malformed EPUB files. An attacker could potentially use this vulnerability to cause a denial of service. (CVE-2019-13032)
Mike Salvatore discovered that FlightCrew mishandled certain malformed EPUB files. An attacker could use this vulnerability to write arbitrary files to the filesystem. (CVE-2019-13241)
Mike Salvatore discovered that the version of Zipios included in FlightCrew mishandled certain malformed ZIP files. An attacker could use this vulnerability to cause a denial of service or consume system resources. (CVE-2019-13453)
- Record
USN-4055-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
flightcrewDebian:12 |
before 0.7.2+dfsg-14 | 0.7.2+dfsg-14 |
flightcrewDebian:13 |
before 0.7.2+dfsg-14 | 0.7.2+dfsg-14 |
flightcrewDebian:14 |
before 0.7.2+dfsg-14 | 0.7.2+dfsg-14 |
flightcrewMageia:7 |
before 0.9.0-10.1.mga7 | 0.9.0-10.1.mga7 |
flightcrewUbuntu:16.04:LTS |
before 0.7.2+dfsg-6ubuntu0.1, plus listed versions 0.7.2+dfsg-20.7.2+dfsg-30.7.2+dfsg-40.7.2+dfsg-50.7.2+dfsg-6 |
0.7.2+dfsg-6ubuntu0.1 |
flightcrewUbuntu:18.04:LTS |
before 0.7.2+dfsg-10ubuntu0.1, plus listed versions 0.7.2+dfsg-90.7.2+dfsg-9build10.7.2+dfsg-9build20.7.2+dfsg-10 |
0.7.2+dfsg-10ubuntu0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-13241 is a high vulnerability (CVSS 7.8) in Flightcrew Project Flightcrew, published July 4, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.63%, the 76th percentile. Fixed in flightcrew 0.7.2+dfsg-14.