Directory Traversal Vulnerability in DPKG by Debian

CVE-2026-91094

What is CVE-2026-91094?

A directory traversal vulnerability exists in DPKG when unpacking 3.0 (quilt) source packages, allowing an attacker to manipulate the file system through crafted tarballs. The flaw arises when an attacker-controlled symlink is included in the quilt database directory (.pc) within a packaging tarball. This can result in an exploit that modifies or deletes files for which these symlinks point, particularly when patches fail to apply correctly during the restoration of backup files. Proper validation and sanitization of paths are crucial to mitigate the risks associated with this vulnerability.

References