---
id: "CVE-2026-91094"
page: "https://infrastack.ai/live/CVE-2026-91094"
kind: "vulnerability"
aliases: ["CVE-2026-91094"]
title: "dpkg-source: crafted 3.0 (quilt) source packages can alter files outside the tree"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["debian", "dpkg-source", "package", "source-packages"]
not_affected_if: ["no-untrusted-source-packages"]
published_at: "2026-11-13T14:18:01+00:00"
first_seen_at: "2026-11-13T15:19:50+00:00"
updated_at: "2026-11-13T15:21:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91094", "first_seen_at": "2026-11-13T15:19:50+00:00"}]
exploit_sources: []
---

# dpkg-source: crafted 3.0 (quilt) source packages can alter files outside the tree

Link for people: https://infrastack.ai/live/CVE-2026-91094 (this .md is for agents)

A crafted Debian 3.0 (quilt) source package can include a quilt database directory with symlinks that point at files elsewhere on disk. When a patch fails to apply during unpacking, the restore step can modify or delete the files those symlinks point to.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-13T15:19:50+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91094

## From the sources

A directory traversal bug was discovered when unpacking 3.0 (quilt) source packages, where the packaging tarball could contain the quilt database directory (.pc) with attacker controlled symlinks, where that in combination with patches that would fail to apply, could be used to make the code used to restore the backup files to either modify or remove the files pointed to by the attacker controlled symlinks.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_