CVE-2017-5982 Directory traversal vulnerability in the Chorus2 2.4.2 add-on for Kodi allows remote attackers to read arbitrary files via a %2E%2E%252e (encoded dot dot slash) in the image path, as demonstrated by i...
HighCVSS 7.5
EPSS 78.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Directory traversal vulnerability in the Chorus2 2.4.2 add-on for Kodi allows remote attackers to read arbitrary files via a %2E%2E%252e (encoded dot dot slash) in the image path, as demonstrated by image/image%3A%2F%2F%2e%2e%252fetc%252fpasswd.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/kodi(Debian:12) | < 2:18.6+dfsg1-1 | 2:18.6+dfsg1-1 |
| debian/kodi(Debian:13) | < 2:18.6+dfsg1-1 | 2:18.6+dfsg1-1 |
| debian/kodi(Debian:14) | < 2:18.6+dfsg1-1 | 2:18.6+dfsg1-1 |
| kodi | = 17.1 | No fix listed |
| ubuntu/kodi(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/kodi(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/kodi(Ubuntu:26.10) | All versions | No fix listed |
| ubuntu/kodi(Ubuntu:22.04) | All versions | No fix listed |
References
- Debian Security Tracker CVE-2017-5982 vendor-advisory
- bugs.debian.org issue-tracking
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- 20170214 [Kodi v17.1] - Local File Inclusion exploit mailing-list third-party-advisory vdb-entry
- 96481 vdb-entry
- [debian-lts-announce] 20240123 [SECURITY] [DLA 3712-1] kodi security update mailing-list
- 41312 exploit third-party-advisory vdb-entry