CVE-2026-91094
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
A directory traversal bug was discovered when unpacking 3.0 (quilt) source packages, where the packaging tarball could contain the quilt database directory (.pc) with attacker controlled symlinks, where that in combination with patches that would fail to apply, could be used to make the code used to restore the backup files to either modify or remove the files pointed to by the attacker controlled symlinks.
| Vendor | debian |
| Product | dpkg |
| Ecosystems | |
| Industries | Technology |
| Published | Nov 13, 2026 |
| Last Updated | Nov 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for debian dpkg
Be the first to know when new unknown vulnerabilities affecting debian dpkg are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Debian / dpkg
0 < 1.23.12
References
Credits
🔍 Thai Duong