CVE-2018-1000849

Name: CVE-2018-1000849
Creator: NVD / NIST
Published: 2018-12-20T15:29:02.347+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 3.53%

Last modified Jun 17, 2026

CVE-2018-1000849 is a vulnerability of currently unknown severity. Alpine Linux version Versions prior to 2.6.10, 2.7.6, and 2.10.1 contains a Other/Unknown vulnerability in apk-tools (Alpine Linux' package manager) that can result in Remote Code Execution. This attack appear to be exploitable via A specially crafted APK-file can cause apk to write arbitrary data to an attacker-specified file, due to bugs in handling long link target name and the way a regular file is extracted.. EPSS estimates a 3.53% chance of exploitation in the next 30 days.

Description

Alpine Linux version Versions prior to 2.6.10, 2.7.6, and 2.10.1 contains a Other/Unknown vulnerability in apk-tools (Alpine Linux' package manager) that can result in Remote Code Execution. This attack appear to be exploitable via A specially crafted APK-file can cause apk to write arbitrary data to an attacker-specified file, due to bugs in handling long link target name and the way a regular file is extracted.. This vulnerability appears to have been fixed in 2.6.10, 2.7.6, and 2.10.1.

Metrics

EPSS Probability

3.53%

87.8th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-20

Affected Software

Vendor	Product	Versions
Alpinelinux	Alpine Linux	< 2.6.10
Alpinelinux	Alpine Linux	>= 2.7.0, < 2.7.6
Alpinelinux	Alpine Linux	>= 2.7.7, < 2.10.1

References

https://alpinelinux.org/posts/Alpine-3.8.1-released.htmlVendor Advisory
https://git.alpinelinux.org/cgit/apk-tools/commit/?id=6484ed9849f03971eb48ee1fdc21a2f128247eb1Patch, Vendor Advisory
https://justi.cz/security/2018/09/13/alpine-apk-rce.htmlExploit, Third Party Advisory
https://alpinelinux.org/posts/Alpine-3.8.1-released.htmlVendor Advisory
https://git.alpinelinux.org/cgit/apk-tools/commit/?id=6484ed9849f03971eb48ee1fdc21a2f128247eb1Patch, Vendor Advisory
https://justi.cz/security/2018/09/13/alpine-apk-rce.htmlExploit, Third Party Advisory

Timeline

Published: Dec 20, 2018
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2018-1000849?

How severe is CVE-2018-1000849?

Severity scoring for CVE-2018-1000849 is pending analysis. The EPSS model estimates a 3.53% probability of exploitation in the next 30 days.

How do I fix CVE-2018-1000849?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2018-1000849?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST