CVE-2007-6610: unp 1.0.12, and other versions before 1.0.14, does not properly escape file names, which might allow contex...

Security readout for executives and security teams

This is a command injection risk in unp, a command-line unpacking helper. Older versions did not safely handle filenames containing shell metacharacters. If another application passes attacker-controlled filenames to unp, the filename could cause unintended command execution. The record notes the issue may depend on third-party invocation, so exposure is narrower than simply having unp installed. Likely exposure is systems with unp versions before 1.0.14, especially where scripts, mail handlers, upload processors, or other products call unp on untrusted filenames. The source bundle does not identify specific downstream products. Treat this as a targeted hygiene item unless unp is used in automated file-processing paths. Prioritize internet-facing upload, mail, ticketing, and archive-processing systems first because command execution impact can be serious when reachable. Mitigation focus: Upgrade unp to version 1.0.14 or later where available.; Check Gentoo, Debian, or other vendor package guidance for supported fixes.; Avoid passing untrusted filenames to unp through shell-interpreted workflows..

Prepared

Jun 28, 2026, 19:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.