CVE-2015-1038

p7zip 9.20.1 allows remote attackers to write to arbitrary files via a symlink attack in an archive.

5.8 MediumFix available

p7zip 9.20.1 allows remote attackers to write to arbitrary files via a symlink attack in an archive.

Exploit likelihood

3.29%Up 1.3 points since Feb 4, 2022

What each source reports

NVD Score used 5.8

p7zip 9.20.1 allows remote attackers to write to arbitrary files via a symlink attack in an archive.

Record: CVE-2015-1038
CVSS 2.0: 5.8 MediumAV:N/AC:M/Au:N/C:N/I:P/A:P
Weakness: CWE-59
Updated: 2026-11-02

CVE List No score

p7zip 9.20.1 allows remote attackers to write to arbitrary files via a symlink attack in an archive.

Record: CVE-2015-1038
Updated: 2026-11-02

EUVDEUVD-2015-1182 No score

p7zip 9.20.1 allows remote attackers to write to arbitrary files via a symlink attack in an archive.

Record: EUVD-2015-1182
Updated: 2026-11-03

GitHub AdvisoriesGHSA-f24r-hqqw-w96v No score

p7zip 9.20.1 allows remote attackers to write to arbitrary files via a symlink attack in an archive.

p7zip 9.20.1 allows remote attackers to write to arbitrary files via a symlink attack in an archive.

Record: GHSA-f24r-hqqw-w96v
Weakness: CWE-59
Updated: 2026-11-02

OSV No score

p7zip 9.20.1 allows remote attackers to write to arbitrary files via a symlink attack in an archive.

Record: CVE-2015-1038
Updated: 2026-11-02

OSVDEBIAN-CVE-2015-1038 No score

p7zip 9.20.1 allows remote attackers to write to arbitrary files via a symlink attack in an archive.

Record: DEBIAN-CVE-2015-1038
Updated: 2026-11-02

Show 4 moreShow less

OSVMGASA-2015-0252 No score

Updated p7zip package fixes security vulnerability

Alexander Cherepanov discovered that p7zip is susceptible to a directory traversal vulnerability. While extracting an archive, it will extract symlinks and then follow them if they are referenced in further entries. This can be exploited by a rogue archive to write files outside the current directory (CVE-2015-1038).

Record: MGASA-2015-0252
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10322-1 No score

p7zip-16.02-2.1 on GA media

These are all security issues fixed in the p7zip-16.02-2.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10322-1
Updated: 2026-11-02

OSVSUSE-SU-2015:1433-1 No score

Security update for p7zip

  This update fixes the following security issue:
  - CVE-2015-1038: directory traversal vulnerability [bnc#912878]

   This could for the overwriting of arbitrary files through uncompressing a crafted archive, with the privileges of the user running 7z

Record: SUSE-SU-2015:1433-1
Updated: 2026-11-02

OSVUBUNTU-CVE-2015-1038 No score

p7zip 9.20.1 allows remote attackers to write to arbitrary files via a symlink attack in an archive.

Record: UBUNTU-CVE-2015-1038
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`p7zip` Debian:12	before 9.20.1~dfsg.1-4.2	9.20.1~dfsg.1-4.2
`p7zip` Debian:13	before 9.20.1~dfsg.1-4.2	9.20.1~dfsg.1-4.2
`p7zip` Debian:6.0	before 9.04~dfsg.1-1+deb6u1, plus listed versions 9.04~dfsg.1-1	9.04~dfsg.1-1+deb6u1
`p7zip` Debian:7	before 9.20.1~dfsg.1-4+deb7u1, plus listed versions 9.20.1~dfsg.1-4	9.20.1~dfsg.1-4+deb7u1
`p7zip` Debian:8	before 9.20.1~dfsg.1-4.1+deb8u1, plus listed versions 9.20.1~dfsg.1-4.1	9.20.1~dfsg.1-4.1+deb8u1
`p7zip` Mageia:4	before 9.20.1-4.1.mga4	9.20.1-4.1.mga4
`p7zip` Mageia:5	before 9.20.1-6.1.mga5	9.20.1-6.1.mga5
`p7zip` SUSE:Linux Enterprise Desktop 12	before 9.20.1-3.2	9.20.1-3.2
`p7zip` SUSE:Linux Enterprise Server 12	before 9.20.1-3.2	9.20.1-3.2
`p7zip` SUSE:Linux Enterprise Server for SAP Applications 12	before 9.20.1-3.2	9.20.1-3.2
`p7zip` Ubuntu:14.04:LTS	before 9.20.1~dfsg.1-4+deb7u1build0.14.04.1, plus listed versions 9.20.1~dfsg.1-4	9.20.1~dfsg.1-4+deb7u1build0.14.04.1
`p7zip` openSUSE:Tumbleweed	before 16.02-2.1	16.02-2.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-1038 is a medium vulnerability (CVSS 5.8) in 7-zip P7zip, published January 21, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.29%, the 88th percentile. Fixed in p7zip 9.20.1~dfsg.1-4.2.

References

Show 17 moreShow less