CVE-2026-8274

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A security vulnerability has been detected in npitre cramfs-tools up to 2.1. Affected is the function do_directory of the file cramfsck.c of the component Directory Handler. Such manipulation leads to path traversal. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. Upgrading to version 2.2 is able to address this issue. The name of the patch is 2fc492747115b24d8a07eddd27a2d45229cb273c. Upgrading the affected component is recommended.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
May 11, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-827402.1Improper Input Validation vulnerability in ash-project ash fails to enforce the outer array constraints on a doubly-nested {:array, {:array,CVE-2026-827412.1Improper Validation of Specified Type of Input vulnerability in ash-project ash lets an attacker confuse the stored type tag of an Ash.Type.CVE-2026-827425.9Uncontrolled Resource Consumption vulnerability in ash-project ash lets an attacker exhaust node memory by matching a filter that spans multCVE-2026-827432.1Uncontrolled Resource Consumption vulnerability in ash-project ash lets a slow asynchronous read spin a scheduler thread at full CPU while tCVE-2026-827442.1Not Failing Securely (Failing Open) vulnerability in ash-project ash skips an Ash.Reactor change when the guard controlling it raises, so a CVE-2026-827455.9Improper Access Control vulnerability in ash-project ash lets a create action overwrite an existing record when the ETS or Mnesia data layerCVE-2026-827465.9Missing Authorization vulnerability in ash-project ash allows an actor to update records forbidden by resource policies through the atomic pCVE-2026-827475.9Incorrect Authorization vulnerability in ash-project ash returns records that a runtime read policy denies to any actor. When a resource haCVE-2026-827482.1Incorrect Authorization vulnerability in ash-project ash authorizes an aggregate under one read action while computing it under another, so CVE-2026-827495.9Incorrect Authorization vulnerability in ash-project ash widens a relationship's parent(...) scoping filter to match unintended records whenCVE-2026-82753.7A vulnerability was detected in bettercap up to 2.41.5. Affected by this vulnerability is the function ippReadChunkedBody of the file moduleCVE-2026-827508.3Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cos
CVE-2026-8274: Medium severity, CVSS 5.3 | Vulnix