VULNERABILITY INTELLIGENCE
CVE-2017-14804
CVSS score9.9 CRITICAL
EPSS probability1.71%
CISA KEVNot currently listed
Published2018-03-01
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Description
The build package before 20171128 did not check directory names during extraction of build results that allowed untrusted builds to write outside of the target system,allowing escape out of buildroots.
Weakness classification
- CWE-20: Improper Input Validation
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')