{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-91094", "assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5", "state": "PUBLISHED", "assignerShortName": "debian", "dateReserved": "2026-09-14T18:35:52.245Z", "datePublished": "2026-11-13T14:01:22.128Z", "dateUpdated": "2026-11-13T14:14:35.366Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5", "shortName": "debian", "dateUpdated": "2026-11-13T14:14:35.366Z"}, "affected": [{"vendor": "Debian", "product": "dpkg", "versions": [{"status": "affected", "version": "0", "lessThan": "1.23.12", "versionType": "semver"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "A directory traversal bug was discovered when unpacking 3.0 (quilt) source packages, where the packaging tarball could contain the quilt database directory (.pc) with attacker controlled symlinks, where that in combination with patches that would fail to apply, could be used to make the code used to restore the backup files to either modify or remove the files pointed to by the attacker controlled symlinks.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>A directory traversal bug was discovered when unpacking 3.0 (quilt) source packages, where the packaging tarball could contain the quilt database directory (.pc) with attacker controlled symlinks, where that in combination with patches that would fail to apply, could be used to make the code used to restore the backup files to either modify or remove the files pointed to by the attacker controlled symlinks.</p>"}]}], "references": [{"url": "https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=50fb8e7fe20cee0d5b14000c32ca8c31f3bf0574", "tags": ["patch"]}, {"url": "https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=2a31760bc2a968878700476c1de5b8ea7809e460", "tags": ["patch"]}], "credits": [{"lang": "en", "value": "Thai Duong", "type": "reporter"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "dpkg", "vendor": "Debian", "versions": [{"lessThan": "1.23.12", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@debian.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A directory traversal bug was discovered when unpacking 3.0 (quilt) source packages, where the packaging tarball could contain the quilt database directory (.pc) with attacker controlled symlinks, where that in combination with patches that would fail to apply, could be used to make the code used to restore the backup files to either modify or remove the files pointed to by the attacker controlled symlinks."}], "id": "CVE-2026-91094", "lastModified": "2026-11-13T14:18:01.670", "metrics": {}, "published": "2026-11-13T14:18:01.670", "references": [{"source": "security@debian.org", "url": "https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=2a31760bc2a968878700476c1de5b8ea7809e460"}, {"source": "security@debian.org", "url": "https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=50fb8e7fe20cee0d5b14000c32ca8c31f3bf0574"}], "sourceIdentifier": "security@debian.org", "vulnStatus": "Received"}

{}

{}