CVE-2013-0261
Packstack: packstack: arbitrary file overwrite via symlink attack
CVE-2013-0261 is a high vulnerability (CVSS 8.8) in Openstack Essex, published March 8, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in openstack-packstack 0:2012.2.2-1.0.dev408.el6ost.
A flaw was found in PackStack. A local user could exploit a symlink attack on a temporary file with a predictable name in the /tmp directory. This vulnerability allows the local user to overwrite arbitrary files on the system, potentially leading to system compromise or data corruption.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Packstack: packstack: arbitrary file overwrite via symlink attack
A flaw was found in PackStack. A local user could exploit a symlink attack on a temporary file with a predictable name in the /tmp directory. This vulnerability allows the local user to overwrite arbitrary files on the system, potentially leading to system compromise or data corruption.
- Record
CVE-2013-0261- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-59
- Updated
- 2026-11-02
EUVDEUVD-2013-0291
A flaw was found in PackStack. A local user could exploit a symlink attack on a temporary file with a predictable name in the /tmp directory. This vulnerability allows the local user to overwrite arbitrary files on the system, potentially leading to system compromise or data corruption.
- Record
EUVD-2013-0291- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-846g-25mr-v9p5
(1) installer/basedefs.py and (2) modules/ospluginutils.py in PackStack allows local users to...
(1) installer/basedefs.py and (2) modules/ospluginutils.py in PackStack allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in /tmp.
- Record
GHSA-846g-25mr-v9p5- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-59
- Updated
- 2026-11-02
NVD
A flaw was found in PackStack. A local user could exploit a symlink attack on a temporary file with a predictable name in the /tmp directory. This vulnerability allows the local user to overwrite arbitrary files on the system, potentially leading to system compromise or data corruption.
- Record
CVE-2013-0261- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - CVSS 2.0
- 4.4 Medium
AV:L/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-59, CWE-264
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openstack-packstackRed Hat:openstack:2::el6 |
before 0:2012.2.2-1.0.dev408.el6ost | 0:2012.2.2-1.0.dev408.el6ost |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-02 | created | CVE List, EUVD, GitHub Advisories, NVD, OSV |
References
rhn.redhat.com/errata/RHSA-2013-0595.html
access.redhat.com/errata/RHSA-2013:0595
bugzilla.redhat.com/show_bug.cgi?id=908101
nvd.nist.gov/vuln/detail/CVE-2013-0261
github.com/advisories/GHSA-846g-25mr-v9p5
Show 21 moreShow less
security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0595.json
cve.org/CVERecord?id=CVE-2013-0261