CVE-2015-2060: cabextract before 1.6 does not properly check for leading slashes when extracting files, which allows remot...

Security readout for executives and security teams

CVE-2015-2060 affects cabextract before 1.6. A specially crafted cabinet file could cause extraction to write using an absolute path, potentially placing files outside the intended directory. Business risk depends on whether untrusted CAB files are processed automatically or with elevated privileges. Exposure is most likely on Linux or Unix systems, mail gateways, build pipelines, or malware-analysis workflows that use cabextract before 1.6 to process untrusted CAB files. Prioritize remediation where cabextract processes external files automatically or with privileged permissions. For isolated manual use, urgency is lower, but upgrading is straightforward and removes a known traversal risk. Mitigation focus: Upgrade cabextract to version 1.6 or later.; Apply distribution vendor security updates where cabextract is packaged.; Avoid extracting untrusted CAB files with elevated privileges..

Prepared

Jun 6, 2026, 04:48 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.