CVE-2019-14452 is a directory traversal vulnerability affecting Sigil before version 0.9.16, as well as related Canonical and FlightCrew products. This flaw allows an unauthenticated attacker to write arbitrary files to a system by crafting a malicious ZIP archive containing "dot dot slash" (../) sequences that are mishandled during extraction. Rated with a CVSS score of 7.5 (HIGH), the vulnerability has a low attack complexity and can lead to high integrity impact, though confidentiality and availability are not directly affected. The attack vector is network-based, meaning no user interaction is required. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, indicating a low level of public awareness.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 0.9.16CPE matchmatch criteria | cpe:2.3:a:sigil-ebook:sigil:*:*:*:*:*:*:*:* | ||
>= 0.9.2CPE matchmatch criteria | cpe:2.3:a:flightcrew_project:flightcrew:*:*:*:*:*:sigil:*:* | ||
16.04CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* | ||
18.04CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* | ||
19.04CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.