{"id":"CVE-2018-12562","aliases":["DEBIAN-CVE-2018-12562","EUVD-2018-4522","GHSA-fcgh-v75r-28pj","MGASA-2018-0314"],"status":"published","title":"An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. The...","description":"An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. The wrapper script 'mount.cifs.wrapper' uses the shell to forward the arguments to the actual mount.cifs binary. The shell evaluates wildcards (such as in an injected string:/home/../tmp/* string).","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01661,"percentile":0.76834,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2018-06-19T05:00:00Z","modified":"2026-10-23T18:03:29Z","fixes":[{"ecosystem":"Debian:12","package":"cantata","fixed_in":["2.3.0.ds1-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"cantata","fixed_in":["2.3.0.ds1-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cantata","fixed_in":["2.3.0.ds1-2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"cantata","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0.ds1-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"cantata","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0.ds1-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"cantata","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0.ds1-2"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"cantata","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-5.1.mga6"}]}],"bundled":4}],"products":[{"vendor":"cantata_project","product":"cantata"}],"references":[{"url":"https://github.com/CDrummond/cantata/commit/afc4f8315d3e96574925fb530a7004cc9e6ce3d3","tags":["x_refsource_MISC","x_transferred","Patch","Technical Description","fix"]},{"url":"http://www.openwall.com/lists/oss-security/2018/06/18/1","tags":["x_refsource_MISC","x_transferred","Mailing List","Technical Description","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-12562"},{"url":"https://github.com/advisories/GHSA-fcgh-v75r-28pj"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-12562","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0314.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23201","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2018/06/19/1","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-12562","description":"An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. The wrapper script 'mount.cifs.wrapper' uses the shell to forward the arguments to the actual mount.cifs binary. The shell evaluates wildcards (such as in an injected string:/home/../tmp/* string).","status":"published","published":"2018-06-19T05:00:00Z","modified":"2024-08-05T08:38:06.318Z","updated_at":"2026-11-02T14:35:06.320867Z"}],"euvd":[{"id":"EUVD-2018-4522","description":"An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. The wrapper script 'mount.cifs.wrapper' uses the shell to forward the arguments to the actual mount.cifs binary. The shell evaluates wildcards (such as in an injected string:/home/../tmp/* string).","status":"published","published":"2018-06-19T05:00:00Z","modified":"2024-08-05T08:38:06Z","updated_at":"2026-11-03T02:39:52.61924Z"}],"ghsa":[{"id":"GHSA-fcgh-v75r-28pj","title":"An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. The...","description":"An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. The wrapper script 'mount.cifs.wrapper' uses the shell to forward the arguments to the actual mount.cifs binary. The shell evaluates wildcards (such as in an injected string:/home/../tmp/* string).","status":"published","published":"2022-05-14T03:08:17Z","modified":"2023-02-02T05:06:58Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:52:24.271651Z"}],"nvd":[{"id":"CVE-2018-12562","description":"An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. The wrapper script 'mount.cifs.wrapper' uses the shell to forward the arguments to the actual mount.cifs binary. The shell evaluates wildcards (such as in an injected string:/home/../tmp/* string).","status":"published","published":"2018-06-19T05:29:00.45Z","modified":"2026-06-17T01:37:58.783Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:04:29.837913Z"}],"osv":[{"id":"CVE-2018-12562","description":"An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. The wrapper script 'mount.cifs.wrapper' uses the shell to forward the arguments to the actual mount.cifs binary. The shell evaluates wildcards (such as in an injected string:/home/../tmp/* string).","status":"published","published":"2018-06-19T05:29:00.45Z","modified":"2026-10-20T13:36:35.581676855Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:07.934182Z"},{"id":"DEBIAN-CVE-2018-12562","description":"An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. The wrapper script 'mount.cifs.wrapper' uses the shell to forward the arguments to the actual mount.cifs binary. The shell evaluates wildcards (such as in an injected string:/home/../tmp/* string).","status":"published","published":"2018-06-19T05:29:00.45Z","modified":"2026-10-23T18:03:29.498194695Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:30.290351Z"},{"id":"MGASA-2018-0314","title":"Updated cantata packages fix security vulnerability","description":"The mount target path check in mounter.cpp 'mpOk()' is insufficient. A\nregular user can this way mount a CIFS filesystem anywhere, and not just\nbeneath /home by passing relative path components (CVE-2018-12559).\n\nArbitrary unmounts can be performed by regular users the same way\n(CVE-2018-12560).\n\nA regular user can inject additional mount options like file_mode= by\nmanipulating e.g. the domain parameter of the samba URL (CVE-2018-12561).\n\nThe wrapper script 'mount.cifs.wrapper' uses the shell to forward the\narguments to the actual mount.cifs binary. The shell evaluates wildcards\nwhich can also be injected (CVE-2018-12562).\n\nTo fix these issues, the vulnerable D-Bus service has been removed.\n","status":"published","published":"2018-07-13T19:01:19Z","modified":"2026-04-16T06:24:17.092234028Z","updated_at":"2026-11-02T15:49:40.793816Z"}]}}