CVE-2018-1000801

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

okular version 18.08 and earlier contains a Directory Traversal vulnerability in function "unpackDocumentArchive(...)" in "core/document.cpp" that can result in Arbitrary file creation on the user workstation. This attack appear to be exploitable via he victim must open a specially crafted Okular archive. This issue appears to have been corrected in version 18.08.1

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bugs.kde.org/show_bug.cgi?id=398096Exploit, Issue Tracking, Patch, Third Party Advisory
https://cgit.kde.org/okular.git/commit/?id=8ff7abc14d41906ad978b6bc67e69693863b9d47Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/09/msg00027.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/201811-08Third Party Advisory
https://www.debian.org/security/2018/dsa-4303Third Party Advisory
https://bugs.kde.org/show_bug.cgi?id=398096Exploit, Issue Tracking, Patch, Third Party Advisory
https://cgit.kde.org/okular.git/commit/?id=8ff7abc14d41906ad978b6bc67e69693863b9d47Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/09/msg00027.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/201811-08Third Party Advisory
https://www.debian.org/security/2018/dsa-4303Third Party Advisory

Timeline

Published: Sep 6, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-10008029.8Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('C CVE-2018-10008035.3Gitea version prior to version 1.5.1 contains a CWE-200 vulnerability that can result in Exposure of users private email addresses. This att CVE-2018-10008049.8contiki-ng version 4 contains a Buffer Overflow vulnerability in AQL (Antelope Query Language) database engine that can result in Attacker c CVE-2018-10008058.8Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can CVE-2018-10008078.1Python Cryptographic Authority pyopenssl version prior to version 17.5.0 contains a CWE-416: Use After Free vulnerability in X509 object han CVE-2018-10008085.9Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Referen CVE-2018-10008097.5privacyIDEA version 2.23.1 and earlier contains a Improper Input Validation vulnerability in token validation api that can result in Denial-CVE-2018-10008109.8The Rust Programming Language Standard Library version 1.29.0, 1.28.0, 1.27.2, 1.27.1, 127.0, 126.2, 126.1, 126.0 contains a CWE-680: Intege CVE-2018-10008118.8bludit version 3.0.0 contains a Unrestricted Upload of File with Dangerous Type vulnerability in Content Upload in Pages Editor that can res CVE-2018-10008128.1Artica Integria IMS version 5.0 MR56 Package 58, likely earlier versions contains a CWE-640: Weak Password Recovery Mechanism for Forgotten CVE-2018-10008134.8Backdrop CMS version 1.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Sanitization of custom class names used on bl CVE-2018-10008146.5aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage th