{"id":"CVE-2019-9686","aliases":["ALPINE-CVE-2019-9686","EUVD-2019-19052","GHSA-2fr8-9j8m-w8vx"],"status":"published","title":"pacman before 5.1.3 allows directory traversal when installing a remote package via a specified...","description":"pacman before 5.1.3 allows directory traversal when installing a remote package via a specified URL \"pacman -U \u003curl\u003e\" due to an unsanitized file name received from a Content-Disposition header. pacman renames the downloaded package file to match the name given in this header. However, pacman did not sanitize this name, which may contain slashes, before calling rename(). A malicious server (or a network MitM if downloading over HTTP) can send a Content-Disposition header to make pacman place the file anywhere in the filesystem, potentially leading to arbitrary root code execution. Notably, this bypasses pacman's package signature checking. This occurs in curl_download_internal in lib/libalpm/dload.c.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0338,"percentile":0.88863,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2019-03-11T16:00:00Z","modified":"2026-11-03T06:32:35Z","fixes":[{"ecosystem":"Alpine:v3.11","package":"pacman","fixed_in":["5.1.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"pacman","fixed_in":["5.1.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"pacman","fixed_in":["5.1.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"pacman","fixed_in":["5.1.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"pacman","fixed_in":["5.1.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"pacman","fixed_in":["5.1.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"pacman","fixed_in":["5.1.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"pacman","fixed_in":["5.1.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"pacman","fixed_in":["5.1.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"pacman","fixed_in":["5.1.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"pacman","fixed_in":["5.1.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"pacman","fixed_in":["5.1.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"pacman","fixed_in":["5.1.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"pacman","fixed_in":["5.1.3-r0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.11","package":"pacman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"pacman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"pacman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"pacman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"pacman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"pacman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"pacman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"pacman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"pacman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"pacman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"pacman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"pacman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"pacman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"pacman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.3-r0"}]}]}],"products":[{"vendor":"pacman_project","product":"pacman"}],"references":[{"url":"https://git.archlinux.org/pacman.git/commit/?id=d197d8ab82cf10650487518fb968067897a12775","tags":["x_refsource_MISC","x_transferred","Mailing List","Patch","Third Party Advisory"]},{"url":"https://git.archlinux.org/pacman.git/commit/?h=release/5.1.x\u0026id=1bf767234363f7ad5933af3f7ce267c123017bde","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory"]},{"url":"https://git.archlinux.org/pacman.git/commit/?id=9702703633bec2c007730006de2aeec8587dfc84","tags":["x_refsource_MISC","x_transferred","Mailing List","Patch","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9686"},{"url":"https://github.com/advisories/GHSA-2fr8-9j8m-w8vx"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-9686","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-9686","description":"pacman before 5.1.3 allows directory traversal when installing a remote package via a specified URL \"pacman -U \u003curl\u003e\" due to an unsanitized file name received from a Content-Disposition header. pacman renames the downloaded package file to match the name given in this header. However, pacman did not sanitize this name, which may contain slashes, before calling rename(). A malicious server (or a network MitM if downloading over HTTP) can send a Content-Disposition header to make pacman place the file anywhere in the filesystem, potentially leading to arbitrary root code execution. Notably, this bypasses pacman's package signature checking. This occurs in curl_download_internal in lib/libalpm/dload.c.","status":"published","published":"2019-03-11T16:00:00Z","modified":"2024-08-04T21:54:45.486Z","updated_at":"2026-11-02T14:20:20.081405Z"}],"euvd":[{"id":"EUVD-2019-19052","description":"pacman before 5.1.3 allows directory traversal when installing a remote package via a specified URL \"pacman -U \u003curl\u003e\" due to an unsanitized file name received from a Content-Disposition header. pacman renames the downloaded package file to match the name given in this header. However, pacman did not sanitize this name, which may contain slashes, before calling rename(). A malicious server (or a network MitM if downloading over HTTP) can send a Content-Disposition header to make pacman place the file anywhere in the filesystem, potentially leading to arbitrary root code execution. Notably, this bypasses pacman's package signature checking. This occurs in curl_download_internal in lib/libalpm/dload.c.","status":"published","published":"2019-03-11T16:00:00Z","modified":"2024-08-04T21:54:45Z","updated_at":"2026-11-03T03:06:37.634716Z"}],"ghsa":[{"id":"GHSA-2fr8-9j8m-w8vx","title":"pacman before 5.1.3 allows directory traversal when installing a remote package via a specified...","description":"pacman before 5.1.3 allows directory traversal when installing a remote package via a specified URL \"pacman -U \u003curl\u003e\" due to an unsanitized file name received from a Content-Disposition header. pacman renames the downloaded package file to match the name given in this header. However, pacman did not sanitize this name, which may contain slashes, before calling rename(). A malicious server (or a network MitM if downloading over HTTP) can send a Content-Disposition header to make pacman place the file anywhere in the filesystem, potentially leading to arbitrary root code execution. Notably, this bypasses pacman's package signature checking. This occurs in curl_download_internal in lib/libalpm/dload.c.","status":"published","published":"2022-05-13T01:13:44Z","modified":"2023-02-01T05:04:12Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:50:07.876412Z"}],"nvd":[{"id":"CVE-2019-9686","description":"pacman before 5.1.3 allows directory traversal when installing a remote package via a specified URL \"pacman -U \u003curl\u003e\" due to an unsanitized file name received from a Content-Disposition header. pacman renames the downloaded package file to match the name given in this header. However, pacman did not sanitize this name, which may contain slashes, before calling rename(). A malicious server (or a network MitM if downloading over HTTP) can send a Content-Disposition header to make pacman place the file anywhere in the filesystem, potentially leading to arbitrary root code execution. Notably, this bypasses pacman's package signature checking. This occurs in curl_download_internal in lib/libalpm/dload.c.","status":"published","published":"2019-03-11T16:29:00.283Z","modified":"2026-06-17T02:44:10.697Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:05:07.268578Z"}],"osv":[{"id":"ALPINE-CVE-2019-9686","description":"pacman before 5.1.3 allows directory traversal when installing a remote package via a specified URL \"pacman -U \u003curl\u003e\" due to an unsanitized file name received from a Content-Disposition header. pacman renames the downloaded package file to match the name given in this header. However, pacman did not sanitize this name, which may contain slashes, before calling rename(). A malicious server (or a network MitM if downloading over HTTP) can send a Content-Disposition header to make pacman place the file anywhere in the filesystem, potentially leading to arbitrary root code execution. Notably, this bypasses pacman's package signature checking. This occurs in curl_download_internal in lib/libalpm/dload.c.","status":"published","published":"2019-03-11T16:29:00.283Z","modified":"2026-11-03T06:32:35.648262436Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:17:20.312441Z"}]}}