CVE-2015-5069

The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in...

4.3 Medium

The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in filesystem_boost.cpp in Battle for Wesnoth before 1.12.3 and 1.13.x before 1.13.1 allow remote attackers to obtain sensitive information via vectors related to inclusion of .pbl files from WML.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: None

Exploit likelihood

1.71%Up 0.1 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

Record: CVE-2015-5069
CVSS 3.0: 4.3 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0: 4.0 MediumAV:N/AC:L/Au:S/C:P/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

CVE List No score

Record: CVE-2015-5069
Updated: 2026-11-02

EUVDEUVD-2015-5085 No score

Record: EUVD-2015-5085
Updated: 2026-11-03

GitHub AdvisoriesGHSA-vppx-q6hc-27h7 4.3

The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in...

Record: GHSA-vppx-q6hc-27h7
CVSS 3.0: 4.3 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

OSVMGASA-2015-0282 No score

Updated wesnoth packages fix security vulnerability

Toom Lõhmus discovered that the Lua API and preprocessor in the Battle for Wesnoth game up to version 1.12.2 included could lead to client-side authentication information disclosure using maliciously crafted files with the .pdb extension (CVE-2015-5069, CVE-2015-5070).

This issue has been fixed using patches from upstream's 1.10.x branch.

Record: MGASA-2015-0282
Updated: 2026-11-02

OSVMGASA-2015-0283 No score

Updated wesnoth packages fix security vulnerability

This issue has been fixed in version 1.12.4, which also provides a number of engine and gameplay-related bug fixes. See the referenced code and player changelogs for a detailed listing.

Record: MGASA-2015-0283
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`wesnoth-1.8` Debian:6.0 From an advisory covering 2 CVEs	before 1:1.8.5-1+deb6u2, plus listed versions 1:1.8.5-1	1:1.8.5-1+deb6u2
`wesnoth` Mageia:4 From an advisory covering 2 CVEs	before 1.10.7-2.2.mga4	1.10.7-2.2.mga4
`wesnoth` Mageia:5 From an advisory covering 2 CVEs	before 1.12.4-1.mga5	1.12.4-1.mga5

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-5069 is a medium vulnerability (CVSS 4.3) in Wesnoth Battle For Wesnoth, published July 27, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.71%, the 77th percentile. No source names a fixed version.

References

Show 14 moreShow less