Every CVESearch/Get API key

CVE-2005-0202

Directory traversal vulnerability in the true_path function in private.py for Mailman 2.1.5 and...

5.0 MediumFix available

CVE-2005-0202 is a medium vulnerability (CVSS 5.0) in Gnu Mailman, published February 9, 2005. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.86%, the 86th percentile. Fixed in mailman 3:2.1.5-24.rhel3.

What does this mean?
Severity
5.0 MediumCVSS 2.0, NVD
Exploit chance
2.86%EPSS, 86th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
3:2.1.5-24.rhel3mailman +16 more

Description

Directory traversal vulnerability in the true_path function in private.py for Mailman 2.1.5 and earlier allows remote attackers to read arbitrary files via ".../....///" sequences, which are not properly cleansed by regular expressions that are intended to remove "../" and "./" sequences.

Exploit likelihood

2.86%Up 0.7 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
mailman
Debian:3.0
From an advisory covering 2 CVEs
before 2.0.11-1woody11, plus listed versions
2.0.11-1woody8
2.0.11-1woody11
mailman
Red Hat:enterprise_linux:3::as
before 3:2.1.5-24.rhel3
3:2.1.5-24.rhel3
mailman-debuginfo
Red Hat:enterprise_linux:3::as
before 3:2.1.5-24.rhel3
3:2.1.5-24.rhel3
mailman
Red Hat:enterprise_linux:3::desktop
before 3:2.1.5-24.rhel3
3:2.1.5-24.rhel3
mailman-debuginfo
Red Hat:enterprise_linux:3::desktop
before 3:2.1.5-24.rhel3
3:2.1.5-24.rhel3
mailman
Red Hat:enterprise_linux:3::es
before 3:2.1.5-24.rhel3
3:2.1.5-24.rhel3
mailman-debuginfo
Red Hat:enterprise_linux:3::es
before 3:2.1.5-24.rhel3
3:2.1.5-24.rhel3
mailman
Red Hat:enterprise_linux:3::ws
before 3:2.1.5-24.rhel3
3:2.1.5-24.rhel3
mailman-debuginfo
Red Hat:enterprise_linux:3::ws
before 3:2.1.5-24.rhel3
3:2.1.5-24.rhel3
mailman
Red Hat:enterprise_linux:4::as
before 3:2.1.5-31.rhel4
3:2.1.5-31.rhel4
Show 7 moreShow less
Affected packages
PackageAffectedFixed
mailman-debuginfo
Red Hat:enterprise_linux:4::as
before 3:2.1.5-31.rhel4
3:2.1.5-31.rhel4
mailman
Red Hat:enterprise_linux:4::desktop
before 3:2.1.5-31.rhel4
3:2.1.5-31.rhel4
mailman-debuginfo
Red Hat:enterprise_linux:4::desktop
before 3:2.1.5-31.rhel4
3:2.1.5-31.rhel4
mailman
Red Hat:enterprise_linux:4::es
before 3:2.1.5-31.rhel4
3:2.1.5-31.rhel4
mailman-debuginfo
Red Hat:enterprise_linux:4::es
before 3:2.1.5-31.rhel4
3:2.1.5-31.rhel4
mailman
Red Hat:enterprise_linux:4::ws
before 3:2.1.5-31.rhel4
3:2.1.5-31.rhel4
mailman-debuginfo
Red Hat:enterprise_linux:4::ws
before 3:2.1.5-31.rhel4
3:2.1.5-31.rhel4

What each source reports

NVD Score used5.0

Directory traversal vulnerability in the true_path function in private.py for Mailman 2.1.5 and earlier allows remote attackers to read arbitrary files via ".../....///" sequences, which are not properly cleansed by regular expressions that are intended to remove "../" and "./" sequences.

Record
CVE-2005-0202
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Updated
2026-11-02
CVE ListNo score

Directory traversal vulnerability in the true_path function in private.py for Mailman 2.1.5 and earlier allows remote attackers to read arbitrary files via ".../....///" sequences, which are not properly cleansed by regular expressions that are intended to remove "../" and "./" sequences.

Record
CVE-2005-0202
Updated
2026-11-02
EUVDEUVD-2005-0203No score

Directory traversal vulnerability in the true_path function in private.py for Mailman 2.1.5 and earlier allows remote attackers to read arbitrary files via ".../....///" sequences, which are not properly cleansed by regular expressions that are intended to remove "../" and "./" sequences.

Record
EUVD-2005-0203
Updated
2026-11-03
GitHub AdvisoriesGHSA-87jx-4wq7-9wr5No score

Directory traversal vulnerability in the true_path function in private.py for Mailman 2.1.5 and...

Directory traversal vulnerability in the true_path function in private.py for Mailman 2.1.5 and earlier allows remote attackers to read arbitrary files via ".../....///" sequences, which are not properly cleansed by regular expressions that are intended to remove "../" and "./" sequences.

Record
GHSA-87jx-4wq7-9wr5
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 18 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open