CVE-2021-41072

CVE-2021-41072 is a directory traversal vulnerability in Squashfs-Tools 4.5, specifically within the squashfs_opendir function in unsquash-2.c. This flaw allows a specially crafted squashfs filesystem, containing a symbolic link and a file with the same name, to trick the unsquashfs utility into writing data outside of its intended directory. Affected products include Debian Linux and Squashfs-Tools. The vulnerability carries a high severity CVSS score of 8.1, indicating a high impact on integrity and availability, with a network attack vector and low attack complexity requiring user interaction. An attacker could leverage this to write arbitrary files to unintended locations on the filesystem. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. The vulnerability has also received minimal community discussion and media coverage, suggesting a low level of public awareness.