{"id":"CVE-2019-13241","aliases":["DEBIAN-CVE-2019-13241","EUVD-2019-4748","GHSA-jff3-mqp2-2qvx","MGASA-2019-0396","UBUNTU-CVE-2019-13241","USN-4055-1"],"status":"published","title":"FlightCrew v0.9.2 and older are vulnerable to a directory traversal, allowing attackers to write...","description":"FlightCrew v0.9.2 and older are vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive entry that is mishandled during extraction.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.0163,"percentile":0.76431,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2019-07-04T00:00:00Z","modified":"2026-10-20T10:51:37Z","fixes":[{"ecosystem":"Debian:12","package":"flightcrew","fixed_in":["0.7.2+dfsg-14"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"flightcrew","fixed_in":["0.7.2+dfsg-14"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"flightcrew","fixed_in":["0.7.2+dfsg-14"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"flightcrew","fixed_in":["0.7.2+dfsg-6ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"flightcrew","fixed_in":["0.7.2+dfsg-10ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"flightcrew","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.2+dfsg-14"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"flightcrew","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.2+dfsg-14"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"flightcrew","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.2+dfsg-14"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"flightcrew","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.0-10.1.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"flightcrew","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.2+dfsg-6ubuntu0.1"}]}],"versions":["0.7.2+dfsg-2","0.7.2+dfsg-3","0.7.2+dfsg-4","0.7.2+dfsg-5","0.7.2+dfsg-6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"flightcrew","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.2+dfsg-10ubuntu0.1"}]}],"versions":["0.7.2+dfsg-9","0.7.2+dfsg-9build1","0.7.2+dfsg-9build2","0.7.2+dfsg-10"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"flightcrew","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.2+dfsg-6ubuntu0.1"}]}],"versions":["0.7.2+dfsg-2","0.7.2+dfsg-3","0.7.2+dfsg-4","0.7.2+dfsg-5","0.7.2+dfsg-6"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"flightcrew","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.2+dfsg-10ubuntu0.1"}]}],"versions":["0.7.2+dfsg-9","0.7.2+dfsg-9build1","0.7.2+dfsg-9build2","0.7.2+dfsg-10"],"bundled":3}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"flightcrew_project","product":"flightcrew"}],"references":[{"url":"https://github.com/Sigil-Ebook/flightcrew/issues/52","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://salvatoresecurity.com/fun-with-fuzzers-how-i-discovered-three-vulnerabilities-part-3-of-3/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://usn.ubuntu.com/4055-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-13241"},{"url":"https://github.com/advisories/GHSA-jff3-mqp2-2qvx"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-13241","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0396.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25281","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-13241","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4055-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-13241","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-13032","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-13453","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-13241","description":"FlightCrew v0.9.2 and older are vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive entry that is mishandled during extraction.","status":"published","published":"2019-07-04T14:31:05Z","modified":"2024-08-04T23:49:23.914Z","updated_at":"2026-11-02T14:20:24.025419Z"}],"euvd":[{"id":"EUVD-2019-4748","description":"FlightCrew v0.9.2 and older are vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive entry that is mishandled during extraction.","status":"published","published":"2019-07-04T14:31:05Z","modified":"2024-08-04T23:49:23Z","updated_at":"2026-11-03T02:40:43.368399Z"}],"ghsa":[{"id":"GHSA-jff3-mqp2-2qvx","title":"FlightCrew v0.9.2 and older are vulnerable to a directory traversal, allowing attackers to write...","description":"FlightCrew v0.9.2 and older are vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive entry that is mishandled during extraction.","status":"published","published":"2022-05-24T16:49:29Z","modified":"2023-03-08T05:05:36Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:54:17.182344Z"}],"nvd":[{"id":"CVE-2019-13241","description":"FlightCrew v0.9.2 and older are vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive entry that is mishandled during extraction.","status":"published","published":"2019-07-04T15:15:11.28Z","modified":"2026-06-17T02:16:21.867Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:05:19.195714Z"}],"osv":[{"id":"CVE-2019-13241","description":"FlightCrew v0.9.2 and older are vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive entry that is mishandled during extraction.","status":"published","published":"2019-07-04T15:15:11.28Z","modified":"2026-10-20T10:51:37.159199531Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:11.029493Z"},{"id":"DEBIAN-CVE-2019-13241","description":"FlightCrew v0.9.2 and older are vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive entry that is mishandled during extraction.","status":"published","published":"2019-07-04T15:15:11.28Z","modified":"2026-09-21T07:01:47.944148642Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.467893Z"},{"id":"UBUNTU-CVE-2019-13241","description":"FlightCrew v0.9.2 and older are vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive entry that is mishandled during extraction.","status":"published","published":"2019-07-04T00:00:00Z","modified":"2026-04-22T12:09:59.68377Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:19.6877Z"},{"id":"MGASA-2019-0396","title":"Updated flightcrew packages fix security vulnerabilities","description":"The updated packages fix security vulnerabilities:\n\nAn issue was discovered in FlightCrew v0.9.2 and earlier. A NULL\npointer dereference occurs in GetRelativePathToNcx() or\nGetRelativePathsToXhtmlDocuments() when a NULL pointer is passed to\nxc::XMLUri::isValidURI(). This affects third-party software (not Sigil)\nthat uses FlightCrew as a library. (CVE-2019-13032)\n\nFlightCrew v0.9.2 and older are vulnerable to a directory traversal,\nallowing attackers to write arbitrary files via a ../ (dot dot slash)\nin a ZIP archive entry that is mishandled during extraction.\n(CVE-2019-13241)\n","status":"published","published":"2019-12-19T13:44:26Z","modified":"2026-04-16T04:40:37.684412715Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"USN-4055-1","title":"flightcrew vulnerabilities","description":"Mike Salvatore discovered that FlightCrew improperly handled certain\nmalformed EPUB files. An attacker could potentially use this vulnerability\nto cause a denial of service. (CVE-2019-13032)\n\nMike Salvatore discovered that FlightCrew mishandled certain malformed EPUB\nfiles. An attacker could use this vulnerability to write arbitrary files to\nthe filesystem. (CVE-2019-13241)\n\nMike Salvatore discovered that the version of Zipios included in FlightCrew\nmishandled certain malformed ZIP files. An attacker could use this vulnerability\nto cause a denial of service or consume system resources. (CVE-2019-13453)\n","status":"published","published":"2019-07-15T13:42:14Z","modified":"2026-04-22T09:59:44.778381Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}