{"id":"CVE-2013-2900","aliases":["DSA-2741-1","EUVD-2013-2839","GHSA-6j6r-x8xq-r7gq","MGASA-2013-0278"],"status":"published","title":"The FilePath::ReferencesParent function in files/file_path.cc in Google Chrome before 29.0.1547...","description":"The FilePath::ReferencesParent function in files/file_path.cc in Google Chrome before 29.0.1547.57 on Windows does not properly handle pathname components composed entirely of . (dot) and whitespace characters, which allows remote attackers to conduct directory traversal attacks via a crafted directory name.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01706,"percentile":0.77444,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2013-08-21T10:00:00Z","modified":"2026-06-16T23:54:11Z","affected":[{"source":"osv","ecosystem":"Debian:7","package":"chromium-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"29.0.1547.57-1~deb7u1"}]}],"versions":["26.0.1410.43-1","27.0.1453.110-1","27.0.1453.110-1~deb7u1","27.0.1453.110-2","27.0.1453.93-1","27.0.1453.93-1~deb7u1","28.0.1500.71-1","28.0.1500.71-1~deb7u1","28.0.1500.71-2","28.0.1500.95-1","28.0.1500.95-1~deb7u1","28.0.1500.95-2","28.0.1500.95-3"],"bundled":7},{"source":"osv","ecosystem":"Mageia:2","package":"chromium-browser-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"29.0.1547.65-1.mga2"}]}],"bundled":7},{"source":"osv","ecosystem":"Mageia:3","package":"chromium-browser-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"29.0.1547.65-1.mga3"}]}],"bundled":7},{"source":"osv","ecosystem":"Mageia:3","package":"chromium-browser-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"29.0.1547.65-1.mga3.tainted"}]}],"bundled":7}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"google","product":"chrome"}],"references":[{"url":"https://src.chromium.org/viewvc/chrome?revision=200603\u0026view=revision","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://googlechromereleases.blogspot.com/2013/08/stable-channel-update.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18381","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred"]},{"url":"http://crbug.com/181617","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.debian.org/security/2013/dsa-2741","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2900"},{"url":"https://github.com/advisories/GHSA-6j6r-x8xq-r7gq"},{"url":"https://advisories.mageia.org/MGASA-2013-0278.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=11049","tags":["report"]},{"url":"http://googlechromereleases.blogspot.com/2013/09/stable-channel-update.html","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-2900","description":"The FilePath::ReferencesParent function in files/file_path.cc in Google Chrome before 29.0.1547.57 on Windows does not properly handle pathname components composed entirely of . (dot) and whitespace characters, which allows remote attackers to conduct directory traversal attacks via a crafted directory name.","status":"published","published":"2013-08-21T10:00:00Z","modified":"2024-08-06T15:52:21.155Z","updated_at":"2026-11-02T14:34:56.530545Z"}],"euvd":[{"id":"EUVD-2013-2839","description":"The FilePath::ReferencesParent function in files/file_path.cc in Google Chrome before 29.0.1547.57 on Windows does not properly handle pathname components composed entirely of . (dot) and whitespace characters, which allows remote attackers to conduct directory traversal attacks via a crafted directory name.","status":"published","published":"2013-08-21T10:00:00Z","modified":"2024-08-06T15:52:21Z","updated_at":"2026-11-03T01:56:37.16587Z"}],"ghsa":[{"id":"GHSA-6j6r-x8xq-r7gq","title":"The FilePath::ReferencesParent function in files/file_path.cc in Google Chrome before 29.0.1547...","description":"The FilePath::ReferencesParent function in files/file_path.cc in Google Chrome before 29.0.1547.57 on Windows does not properly handle pathname components composed entirely of . (dot) and whitespace characters, which allows remote attackers to conduct directory traversal attacks via a crafted directory name.","status":"published","published":"2022-05-17T00:54:28Z","modified":"2023-02-03T05:02:49Z","cwes":["CWE-22"],"updated_at":"2026-11-02T14:53:14.779941Z"}],"nvd":[{"id":"CVE-2013-2900","description":"The FilePath::ReferencesParent function in files/file_path.cc in Google Chrome before 29.0.1547.57 on Windows does not properly handle pathname components composed entirely of . (dot) and whitespace characters, which allows remote attackers to conduct directory traversal attacks via a crafted directory name.","status":"published","published":"2013-08-21T12:17:56.73Z","modified":"2026-06-16T23:54:11.12Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:02:35.248411Z"}],"osv":[{"id":"DSA-2741-1","title":"chromium-browser - several","status":"published","published":"2013-08-25T00:00:00Z","modified":"2026-03-09T01:21:13.448549Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"MGASA-2013-0278","title":"Updated chromium-browser-stable package fix security vulnerabilities","description":"The chrome 29 development team found various issues from internal fuzzing\naudits, and other studies (CVE-2013-2887).\n\nKrystian Bigaj discovered a file handling path sanitization issue\n(CVE-2013-2900).\n\nAlex Chapman discovered an integer overflow issue in ANGLE, the Almost\nNative Graphics Layer (CVE-2013-2901).\n\ncloudfuzzer discovered a use-after-free issue in XSLT (CVE-2013-2902).\n\ncloudfuzzer discovered a use-after-free issue in HTMLMediaElement\n(CVE-2013-2903).\n\ncloudfuzzer discovered a use-after-free issue in XML document parsing\n(CVE-2013-2904).\n\nChristian Jaeger discovered an information leak due to insufficient file\npermissions (CVE-2013-2905).\n","status":"published","published":"2013-09-13T20:29:51Z","modified":"2026-04-16T06:22:35.133346712Z","updated_at":"2026-11-02T15:49:39.121227Z"}]}}