CVE-2017-5982
High · 7.5CVSS
7.5
EPSS
78.0%
Published
Feb 28, 2017
CISA due date
—
The record
Directory traversal vulnerability in the Chorus2 2.4.2 add-on for Kodi allows remote attackers to read arbitrary files via a %2E%2E%252e (encoded dot dot slash) in the image path, as demonstrated by image/image%3A%2F%2F%2e%2e%252fetc%252fpasswd.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:10 | kodi | 0 | 2:17.6+dfsg1-4+deb10u1 |
| Debian:11 | kodi | 0 | 2:18.6+dfsg1-1 |
| Debian:12 | kodi | 0 | 2:18.6+dfsg1-1 |
| Debian:13 | kodi | 0 | 2:18.6+dfsg1-1 |
| Ubuntu:16.04:LTS | kodi | 0 | No fix |
| Ubuntu:18.04:LTS | kodi | 0 | No fix |
| Ubuntu:20.04:LTS | kodi | 0 | 2:18.6+dfsg1-2ubuntu1 |
| Ubuntu:22.04:LTS | kodi | 0 | No fix |
| Ubuntu:24.04:LTS | kodi | 0 | No fix |
| Ubuntu:24.10 | kodi | 0 | No fix |
| Ubuntu:25.04 | kodi | 0 | No fix |
| Ubuntu:25.10 | kodi | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | kodi | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | kodi | 0 | No fix |
Related vulnerabilities
- CVE-2015-3885 Integer overflow in the ljpeg_start function in dcraw 7.00 and earlier allows remote… Also affects kodi
- CVE-2018-8831 A Persistent XSS vulnerability exists in Kodi (formerly XBMC) through 17.6 that allows… Also affects kodi
- CVE-2026-81163 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')… CWE-22
- CVE-2026-112049 Vita3K before build 4187 contains a path traversal (zip slip) vulnerability in… CWE-22
- CVE-2026-112005 WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote… CWE-22
- CVE-2026-61702 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like… CWE-22
- CVE-2026-104871 The Angular SSR is a server-rise rendering tool for Angular applications. CWE-22
- CVE-2026-102991 Mako is a template library written in Python. CWE-22