CVE-2026-91094 · Package
NO FIX YET
A crafted Debian 3.0 (quilt) source package can include a quilt database directory with symlinks that point at files elsewhere on disk. When a patch fails to apply during unpacking, the restore step can modify or delete the files those symlinks point to.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
No product ranges from the sources yet.
Not affected if no-untrusted-source-packages
Who cares debian, dpkg-source, source-packages
Unknown from the sources.
No fix yet, per the sources.
A directory traversal bug was discovered when unpacking 3.0 (quilt) source packages, where the packaging tarball could contain the quilt database directory (.pc) with attacker controlled symlinks, where that in combination with patches that would fail to apply, could be used to make the code used to restore the backup files to either modify or remove the files pointed to by the attacker controlled symlinks.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.