LiveActive security incident?Get immediate response
CVE Record

CVE-2021-40153: squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is...

squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations outside of the destination.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2021-40153 is a path traversal issue in Squashfs-Tools 4.5. If someone extracts a malicious SquashFS image with unsquashfs, filenames inside the image may cause files to be written outside the chosen destination directory. Business risk depends on where untrusted firmware, container, appliance, or filesystem images are unpacked.

Executive priority

Treat this as a targeted operational risk, not an internet-wide emergency. Patch vulnerable extraction tooling where untrusted images are handled, because the issue can turn routine unpacking into unintended file writes outside the expected workspace.

Technical view

The issue is in squashfs_opendir in unsquash-1.c. unsquashfs uses directory-entry filenames without validating that they remain under the extraction destination, allowing traversal outside that directory. Public sources reference upstream issue and commit activity plus Debian, Fedora, Ubuntu, and Gentoo advisories. No CVSS or CWE is present in the provided bundle.

Likely exposure

Exposure is most likely on Linux or build-analysis systems that use unsquashfs to unpack SquashFS images, especially firmware analysis, CI pipelines, appliance inspection, embedded Linux workflows, and administrator workstations processing untrusted images.

Exploitation context

The provided data does not show CISA KEV listing or active exploitation. Exploitation would require a crafted SquashFS image being processed by vulnerable unsquashfs. Impact is constrained by the privileges and filesystem access of the process performing extraction.

Researcher notes

The core weakness is missing destination-boundary validation during unsquashfs extraction. The source bundle supports traversal outside the destination, but does not provide CVSS, CWE, affected downstream package versions, or active exploitation evidence. Use distribution advisories and upstream commit context for precise remediation mapping.

Mitigation direction

  • Update squashfs-tools using the relevant distribution or vendor advisory.
  • Prioritize systems that unpack untrusted SquashFS, firmware, or appliance images.
  • Run extraction workflows with least privilege and isolated work directories.
  • Check upstream and distribution guidance before assuming a fixed version.
  • Restrict automated unpacking of untrusted images until patched.

Validation and detection

  • Inventory hosts and pipelines where unsquashfs is installed or invoked.
  • Compare installed squashfs-tools packages against Debian, Fedora, Ubuntu, or Gentoo advisories.
  • Review extraction workflows for untrusted SquashFS or firmware inputs.
  • Confirm unpacking jobs do not run with unnecessary elevated privileges.
  • Document residual exposure where vendor-fixed packages are unavailable.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-40153 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
9Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.