{"id":"CVE-2026-91094","kind":"vulnerability","aliases":["CVE-2026-91094"],"related":[],"title":"dpkg-source: crafted 3.0 (quilt) source packages can alter files outside the tree","description":"A directory traversal bug was discovered when unpacking 3.0 (quilt) source packages, where the packaging tarball could contain the quilt database directory (.pc) with attacker controlled symlinks, where that in combination with patches that would fail to apply, could be used to make the code used to restore the backup files to either modify or remove the files pointed to by the attacker controlled symlinks.","summary":"A crafted Debian 3.0 (quilt) source package can include a quilt database directory with symlinks that point at files elsewhere on disk. When a patch fails to apply during unpacking, the restore step can modify or delete the files those symlinks point to.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["debian","dpkg-source","package","source-packages"],"not_affected_if":["no-untrusted-source-packages"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-13T14:18:01+00:00","first_seen_at":"2026-11-13T15:19:50+00:00","triaged_at":"2026-11-13T15:21:38+00:00","updated_at":"2026-11-13T15:21:38+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-11-13T15:21:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"dpkg-source: crafted 3.0 (quilt) source packages can alter files outside the tree","impact":"medium","summary":"A crafted Debian 3.0 (quilt) source package can include a quilt database directory with symlinks that point at files elsewhere on disk. When a patch fails to apply during unpacking, the restore step can modify or delete the files those symlinks point to.","audience":"developers","category":"package","nicknames":[],"who_cares":["dpkg-source","debian","source-packages"],"confidence":0.4,"fix_status":"unknown","needs_auth":"no","worst_case":"files outside the source tree get modified or deleted","analyst_note":"Confirm the affected dpkg versions and fixed release from the NVD entry or Debian security tracker.","how_to_check":"- unknown","plain_action":"","product_name":"dpkg-source","needs_analyst":true,"not_affected_if":["no-untrusted-source-packages"],"who_is_affected":"unknown","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00066,"input_tokens":4571,"output_tokens":405,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-91094':17A,20A '3.0':5A,32B,79C 'alter':10A 'appli':56B,108C 'attack':95C,133C 'backup':120C 'bug':74C 'code':115C 'combin':101C 'contain':88C 'control':96C,134C 'could':87C,109C 'craft':4A,30B 'cve':15A,18A 'databas':40B,91C 'debian':21B,31B 'delet':65B 'directori':41B,72C,92C 'discov':76C 'disk':50B 'dpkg':2A,23B 'dpkg-sourc':1A,22B 'either':123C 'elsewher':48B 'fail':54B,106C 'file':11A,47B,67B,121C,128C 'includ':37B 'make':113C 'modifi':63B,124C 'outsid':12A 'packag':8A,25B,28B,35B,82C,85C 'patch':53B,103C 'pc':93C 'point':45B,70B,129C 'quilt':6A,33B,39B,80C,90C 'remov':126C 'restor':60B,118C 'sourc':3A,7A,24B,27B,34B,81C 'source-packag':26B 'step':61B 'symlink':43B,69B,97C,135C 'tarbal':86C 'travers':73C 'tree':14A 'unpack':58B,78C 'use':111C,116C 'would':105C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["debian","dpkgsource","package","sourcepackages","unknown"],"campaign_type":null,"search_a":"'-2026':16A,19A '-91094':17A,20A '3.0':5A 'alter':10A 'craft':4A 'cve':15A,18A 'dpkg':2A 'dpkg-sourc':1A 'file':11A 'outsid':12A 'packag':8A 'quilt':6A 'sourc':3A,7A 'tree':14A","search_b":"'3.0':32B 'appli':56B 'craft':30B 'databas':40B 'debian':21B,31B 'delet':65B 'directori':41B 'disk':50B 'dpkg':23B 'dpkg-sourc':22B 'elsewher':48B 'fail':54B 'file':47B,67B 'includ':37B 'modifi':63B 'packag':25B,28B,35B 'patch':53B 'point':45B,70B 'quilt':33B,39B 'restor':60B 'sourc':24B,27B,34B 'source-packag':26B 'step':61B 'symlink':43B,69B 'unpack':58B","search_c":"'3.0':79C 'appli':108C 'attack':95C,133C 'backup':120C 'bug':74C 'code':115C 'combin':101C 'contain':88C 'control':96C,134C 'could':87C,109C 'databas':91C 'directori':72C,92C 'discov':76C 'either':123C 'fail':106C 'file':121C,128C 'make':113C 'modifi':124C 'packag':82C,85C 'patch':103C 'pc':93C 'point':129C 'quilt':80C,90C 'remov':126C 'restor':118C 'sourc':81C 'symlink':97C,135C 'tarbal':86C 'travers':73C 'unpack':78C 'use':111C,116C 'would':105C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T14:18:01+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91094","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91094","severity":null,"published_at":"2026-11-13T14:18:01+00:00","modified_at":"2026-11-13T14:18:01+00:00","first_seen_at":"2026-11-13T15:19:50+00:00","fetched_at":"2026-11-13T15:19:50+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}